# Common C2 Protocol Implementations

## HTTP/HTTPS-Based C2

### Characteristics
- Blends with normal web traffic
- Uses standard ports (80, 443)
- May use legitimate cloud services as relay

### Common Patterns
- **Check-in**: POST to /gate.php, /panel/gate.php, /api/check
- **Data encoding**: Base64, XOR, custom encoding in POST body or cookies
- **Commands in response**: Encoded in HTML comments, custom headers, JSON body
- **Beaconing**: Regular interval requests with slight jitter

### Detection
- Unusual User-Agent strings
- Regular interval requests to same URI
- Base64/encoded POST data to PHP/ASP endpoints
- Self-signed or unusual TLS certificates (JA3/JA3S fingerprinting)

## DNS-Based C2

### DNS Tunneling
- Data encoded in subdomain labels
- Response in TXT, CNAME, or A records
- Very slow but hard to block

### Indicators
- Very long subdomain names (>30 chars)
- High volume of queries to single domain
- Unusual record types (TXT, NULL, PRIVATE)
- Base32/Base64 encoded subdomain labels

## IRC-Based C2

### Legacy but still used
- Bots join specific channels
- Commands via channel messages or topics
- Authentication via channel keys

### Detection
- Connections to IRC ports (6667, 6697)
- NICK/JOIN/PRIVMSG patterns
- Channel names matching bot patterns

## Custom Binary Protocols

### Characteristics
- Proprietary format over TCP/UDP
- Often encrypted (RC4, AES, XOR)
- Fixed or variable length message structure

### Analysis Approach
1. Capture multiple sessions
2. Identify message boundaries (length fields, delimiters)
3. Find encryption (look for crypto constants in binary)
4. Decrypt and map message types
5. Identify command/response patterns

## Cloud Service Abuse

### Platforms Used
- Telegram Bot API
- Discord webhooks
- Pastebin/GitHub Gists
- Google Sheets/Docs
- Twitter/X (DMs, posts)
- Slack webhooks

### Detection
- API calls to these services from unexpected processes
- Regular polling patterns to social media APIs
- Encoded data in cloud storage