analyzing-command-and-control-communication

1# Analyzing Command-and-Control Communication
2 
3## When to Use
4 
5- Reverse engineering a malware sample has revealed network communication that needs protocol analysis
6- Building network-level detection signatures for a specific C2 framework (Cobalt Strike, Metasploit, Sliver)
7- Mapping C2 infrastructure including primary servers, fallback domains, and dead drops
8- Analyzing encrypted or encoded C2 traffic to understand the command set and data format
9- Attributing malware to a threat actor based on C2 infrastructure patterns and tooling
10 
11**Do not use** for general network anomaly detection; this is specifically for understanding known or suspected C2 protocols from malware analysis.
12 
13## Prerequisites
14 
15- PCAP capture of malware network traffic (from sandbox, network tap, or full packet capture)
16- Wireshark/tshark for packet-level analysis
17- Reverse engineering tools (Ghidra, dnSpy) for understanding C2 code in the malware binary
18- Python 3.8+ with `scapy`, `dpkt`, and `requests` for protocol analysis and replay
19- Threat intelligence databases for C2 infrastructure correlation (VirusTotal, Shodan, Censys)
20- JA3/JA3S fingerprint databases for TLS-based C2 identification
21 
22## Workflow
23 
24### Step 1: Identify the C2 Channel
25 
26Determine the protocol and transport used for C2 communication:
27 
28```
29C2 Communication Channels:
30━━━━━━━━━━━━━━━━━━━━━━━━━
31HTTP/HTTPS:     Most common; uses standard web traffic to blend in
32…