Detect Command and Control (C2) Attacks

FIND DGA, DNS, AND ICMP TUNNELING

Is an attacker remotely controlling assets on your network? Corelight’s C2 Collection has the answers with over 50 unique insights and detections that illuminate command and control activity. Battle-tested by some of the world’s most sophisticated organizations, this collection covers known C2 toolkits and MITRE ATT&CK^® C2 techniques to find novel attacks. Read about how to detect the Manjusaka C2 framework.

Corelight Collections are detection sets included with your Corelight subscription and can be activated depending on your needs.

Catch attacker tunnels camouflaged as normal traffic
Find Cobalt Strike, Empire, Metasploit, and other common tools
50+ unique C2 detections and insights that enhance MITRE ATT&CK coverage

Detections

HTTP C2
Detect known families of malware that conduct C2 communications over HTTP, such as Empire, Metasploit, and Cobalt Strike.

DNS tunneling
Detect DNS tunneling behavior as well as the presence of specific tunneling tools such as Iodine.

ICMP tunneling
Detect ICMP tunneling behavior as well as the presence of specific tunneling tools such as ICMP Shell.

Domain generation algorithms (DGAs)
Detect C2 traffic based on DNS activity from malware using domain generation algorithms.

Meterpreter
Detect C2 activity from Metasploit’s Meterpreter shell across HTTP and generic TCP/UDP traffic.

And more...
Over 50 additional insights and detections.

ANALYTICS

Corelight Collections

Collections are targeted categories of detections, inferences, and data transformation that provide deeper visibility into adversary activity. They cover encrypted traffic, command and control activity, entity activity, ICS/OT visibility, and more. Detections are viewable through Corelight Investigator, or via a SIEM, XDR, or other analytics platform.

C2 COLLECTION

FIND DGA, DNS, AND ICMP TUNNELING

Detections

How it works

ANALYTICS

Corelight Collections

Have questions?

Sign up for our newsletter

Locations

1 (888) 547-9497

We're hiring!