n.Scope NDR v2.0 - EN
  • 👋Welcome
  • Product Guides
    • 📎Explore your Network
    • 🚨Using Alerts
  • Deployment
    • 🛠️Deployment Guide
    • 🗺️n.Scope Deployment Planning
    • 📡Installing Nanocorp n.Scope
      • 👓Deploy n.Scope
      • 🪝Deploy n.Probes, n.Rewind, n.Fusion
  • Ressources
    • 🔦Alerts
      • Command & Control
        • CNC01 - Oversized UDP DNS
        • CNC02 - Protocols Ports Missmatch
        • CNC03 - BETA - Threat Intelligence Match
      • Denial of Service
        • DOS01 - DHCP Starvation
        • DOS02 - AI Smart Alert - Distributed Denial of Service
        • DOS03 - Excessive ICMP Rate
      • Exfiltration
        • EXF01 - Deprecated TLS
      • Initial Access
        • IAC01 - Suspicious SSH Admin
        • IAC02 - Unauthorized Application
        • IAC03 - Malicious TLS Signatures
      • Reconnaissance
        • REC01 - Suspicious Port Scan
        • REC02 - BETA - AI Smart Alert - Suspicious Port Sweep
      • Security Policies
        • NPC01 - Unwanted Protocol
        • NPC02 - Subnet Whitelist
        • NPC03 - Trusted Protocol
        • NPC04 - Insecure Email Protocol
        • NPC05 - Device Whitelist
    • 🔌Integrations
      • 🚦Alerting
        • Discord
        • Slack
      • 🛰️Cyber Threat Intelligence
      • 🔑Single-Sign-On
        • 🪟Azure AD SSO
    • 🤖Network Protocols
Powered by GitBook
On this page
  • What are Command & Control Alert Templates?
  • Supported Templates:
  1. Ressources
  2. Alerts

Command & Control

Last updated 1 year ago

What are Command & Control Alert Templates?

The Command & Control (C2) alert category within the n.Scope Network Detection and Response (NDR) platform is critical for identifying and mitigating threats where attackers seek to establish a remote foothold within a network. C2 communications are a hallmark of advanced persistent threats (APTs) and botnets, where compromised systems are controlled by an external attacker’s server, often for malicious purposes such as data exfiltration, lateral movement, or further exploitation. The alerts in this category are designed to detect the telltale signs of such communications—irregular traffic patterns, suspicious outbound connections, or known malicious IP addresses and domains. By leveraging the n.Scope NDR's advanced analytics and threat intelligence, these alerts enable security teams to quickly isolate affected systems and disrupt the attackers' control channels.

Supported Templates:

🔦
CNC01 - Oversized UDP DNS
CNC02 - Protocols Ports Missmatch
CNC03 - BETA - Threat Intelligence Match