A C2 check-in is a periodic outbound connection from a compromised host to a command-and-control server. Malware uses it to ask for new instructions, report status, upload results, or confirm that it is still running. The traffic is often small, regular, and easy to hide inside normal web requests, DNS lookups, or other allowed protocols.
Defenders watch for C2 check-ins because they can reveal an active compromise even before damage is visible. Common indicators include repeated beaconing at fixed intervals, unusual destinations, strange user-agent strings, or a process that makes network calls it should not. Attackers try to blend these connections into trusted software or tunnels, which is why analysts combine network logs with process lineage, endpoint telemetry, and context about the user’s activity to separate legitimate automation from malware behavior.