Command and control
C2. How the operator talks to a compromised host after they are in. DNS, HTTPS, and traffic that looks like SaaS are common.
Command and control is the channel from operator to implant: tasking, stolen data, updates. Cut it with no failover and that foothold is contained. Kill one IP and they move.
Look for beaconing, odd DNS, new outbound domains, and protocols that do not match the process. Blocking known C2 is hygiene. Finding the channel in your own logs is the job.
See also: Beaconing, DNS, MITRE ATT&CK, Network detection and response.