Command-and-control practice belongs inside defined lab infrastructure. This note covers baseline traffic discipline for controlled exercises: what to measure before the scenario, how to document beacon behavior, and how to compare runs without exporting tradecraft into unauthorized networks.
Lab-only: Apply only in environments you own or are explicitly authorized to test.
Why baselines matter in training
Defenders detect deviation from normal. Operators who never measure their own baseline noise confuse “quiet” with “low signal.” In a lab, capture:
- Egress paths allowed for the exercise
- Expected DNS and HTTP patterns for management tooling
- Time windows when legitimate automation runs
Your scenario report should reference that baseline when explaining why a channel was chosen or avoided.
Pre-run checklist
- Confirm authorization documentation and scope IDs for the lab tenant.
- Snapshot egress allow lists and proxy policies in effect for the exercise window.
- Start a correlated log collection window (operator journal + lab SIEM if provided).
- Record toolchain versions and configuration hashes used for the run.
Document channels by intent, not by brand
Describe channels using properties reviewers care about:
| Property | Example questions |
|---|---|
| Transport | HTTPS, DNS tunneling simulation, etc. |
| Cadence | Jitter profile and sleep rationale |
| Payload staging | Where staging occurred in scope |
| Failure behavior | Retry limits and fallback rules |
Avoid copy-paste configuration dumps in public write-ups. Store detailed configs in the lab evidence bundle.
Detection-aware habits (educational)
Train these habits even when the lab is permissive:
- Name the detections you expect for each channel class.
- Note which actions were deferred because they would exceed scope.
- Compare two channel options with a short tradeoff table in your report.
Pair this with defensive feedback loops so learners see both sides of the same signal.
After action
Export only approved artifacts from the lab environment. Discuss methodology in Intelligence Reports and community debriefs on Discord - not live C2 details outside the lab.
When you need scenario-specific C2 practice aligned to catalog missions, start from The Armory rather than ad hoc infrastructure.
