The C2 Trap

Start at the Beginning. Not at the End

“Let’s start at the very beginning. A very good place to start.”

That applies to detection engineering too.

Time and time again I’ve seen security teams prioritise command-and-control (C2) and data exfiltration far too early. These are serious attacker actions. They feel important. They sound advanced. They seem like the kind of thing a good SOC should be doing.

For most teams, this is a mistake.

I do not think most detection programs should start by trying to detect C2 or exfiltration. In fact, I think many teams should not spend much time on them at all until they have built stronger coverage elsewhere.

Why? Because C2 and exfiltration are hard problems.

Pick Your Battles

The first mistake that teams make is to treat C2 and exfiltration as if they are specific behaviours. They are not. They are outcomes.

The attacker’s goal is to establish a reliable outbound path, or to get data out of your network by any means necessary. That can mean HTTPS, DNS, cloud storage, remote admin tools, SaaS platforms, email, collaboration tools, or traffic that appears indistinguishable from ordinary business activity.

The attacker only needs one working method.

The defender has to spot all plausible methods.

That is the trap.

(cliché narrowly avoided, phew)

This is an asymmetry problem. The defender must cover a huge space. In a large enterprise, with high volumes of business traffic, user behaviour, and a multitude of endpoint software producing endless noise, that is not a battle that most teams are going to win.

Yes, some organisations might be able to do this with highly restrictive egress controls, telemetry from a broad spectrum of network protocols, and non-trivial machine-learning-based analytics. But most teams do not have that. Even if they do, C2 and exfil remain some of the hardest detection problems to solve. Why would any sane person choose to start there?!

If someone has miraculously “solved C2” then they are keeping very quiet about it. Given that such a person would almost certainly become an over night millionaire, I think it’s safe to say the game remains firmly afoot.

Focus on High Signal

Attacks do not begin with stealthy outbound traffic. They begin with, well, initial execution, persistence, credential access, lateral movement. Activities that tend to result in relatively stronger detection signals than C2 and exfil.

For example. Before an attacker can establish a stable C2 channel or exfil your customer data, they need to do things like:

• execute suspicious binaries or scripts
• abuse Office, browsers, or script interpreters
• tamper with security tooling

These are much better starting points because there is far less scope for variation. Theoretically there are infinite ways you can do C2, whereas there are a finite number of ways to dump creds from LSASS. Finite and ever-growing, but finite nonetheless.

A good starting detection is one that gives you a strong signal, clear investigative value, and a realistic chance to intervene before the damage is done.

Too Little Too Late

Its not just that C2 and exfil are hard. It is that they are too late.

If your first meaningful alert is C2, the attacker has already executed code and established control. You have bigger problems to worry about.

If your first meaningful alert is exfiltration, the attacker may already have gained access, obtained credentials, moved laterally, reached important systems, collected data, staged it, and started moving it out. You definitely have bigger problems to worry about.

At that point, you will not be asking, “Can we detect this?”

You will be asking, “Why are we only detecting this now?”

That is not a good place to be.

The kill chain matters, because detection is in part a timing problem. The later you detect, the worse things get. With exfiltration, the data loss event may already have happened.

This does not make late detections useless. It makes them weak candidates for your first and best line of defence.

Where Most Teams Should Start

A team with weak coverage of suspicious execution, credential access, and lateral movement should not be spending their efforts trying to infer beaconing activity from marginal network signals across a noisy environment.

A good detection program asks simple questions first:

Where is the signal strongest?
Where are attacker options narrowest?
Where can we investigate with confidence?
Where can we detect earlier?
Where can we still change the outcome?

For most teams, the answer is not C2.

Focus your efforts on areas like:

• suspicious execution chains
• script interpreter abuse
• Office or browser child-process anomalies
• abuse of admin tooling
• credential access
• interactions with LSASS
• authentication anomalies
• privilege escalation
• remote execution
• lateral movement primitives
• security control tampering

These are not trivial detection problems. However, they are usually better detection problems. They are more tightly bounded and more likely to catch an attacker while they are still forced to do something noisy or unusual.

Jumping straight to C2 means placing your bets on catching the attacker at one of the quietest, most flexible stages in the kill chain.

Someday, Somehow

I am not saying C2 and exfiltration detections are worthless.

They are not.

In restricted environments, crown-jewel enclaves, mature programs, or networks with tight egress control and rich telemetry, they can be useful. In some cases essential.

But they should be regarded as the roof not the foundations.

For most teams, they are a poor starting point. They are not where the early returns are. They are not where the analyst learns fastest. They are not where the defender has the advantage.

Start at the Beginning

C2 and exfiltration are tempting because they sit close to the attacker’s objective. But that is exactly why they are such dangerous starting points. By then the attacker has more options, more cover, and less need to behave in ways you can reliably spot.

Start earlier.

Detect initial execution.
Detect credential access.
Detect lateral movement.

Because if your first alert is “elvis.dit has left the building” then its so long, farewell
auf wiedersehen, goodbye.