The malware command and control (also called C&C or C2) refers to how attackers communicate and exhibit control of the infected system. Upon infecting the system, most malware communicates with the attacker-controlled server (C2 server) either to take commands, download additional components, or to exfiltrate information. Adversaries use different techniques and protocols for command and control. Traditionally, Internet Relay Chat (IRC) used to be the most common C2 channel for many years, but because IRC is not commonly used in organizations, it was possible to detect such traffic easily. Today, the most common protocol used by the malware for the C2 communication is HTTP/HTTPS. Using HTTP/HTTPS allows the adversary to bypass firewalls/network-based detection systems and to blend in with the legitimate web traffic. Malware may sometimes use a protocol such as P2P for C2 communication. Some malware have also used DNS tunneling (https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/) for C2 communications.