In the seven-phase intrusion model, which phase follows Installation?

• A. Delivery
• B. Exploitation
• C. C2 (Command and Control)
• D. Recon

Answer: (C)

In this seven-phase intrusion model, the key idea is the progression of actions once attacker access is gained. After the malware is installed on a target system, the next step is to establish a Command and Control (C2) channel. This phase provides the attacker with a remote conduit to communicate with the compromised host, issue commands, receive data, and coordinate further actions or updates while maintaining control and persistence. Without C2, the installed payload would be isolated and unable to be managed or scaled.

The other phases occur earlier or later in the sequence: reconnaissance happens at the outset to identify targets, delivery and exploitation bring the payload into the environment and trigger installation, and actions on objectives come after control is established to achieve the attacker’s goals.