Command and control
Command and control is communication that an attacker uses to direct activity on compromised systems and receive information from them.
The connection gives the attacker a way to act
An attacker may use purpose-built malware or abuse an ordinary remote-access product. MITRE describes both dedicated channels and communication that blends into familiar traffic. A recognizable application or common network protocol does not establish who is directing the activity.
A legitimate support session is not automatically command and control. Check who initiated it, who approved it, what authority was granted, and what the operator did. The fake IT support article follows the separate decisions to connect, share a screen, and permit control.
A network contact is one piece of evidence
Investigators connect network records with the responsible process, device, and activity that followed. A repeated connection can be a lead; identifying commands or their effects makes the finding more specific. Search ads to execution follows that progression from delivery to endpoint activity.
Command and control also differs from persistence. The communication channel lets the attacker direct activity; a persistence mechanism helps preserve access through interruptions. Some tools can support both.
Blocking a destination can interrupt a channel. Removing the attacker’s access also means investigating the endpoint and any credentials or permissions they obtained; identity containment covers that account and session work.