Once an attacker gains access, they typically want to keep it and control it remotely, even after reboots or password changes. Persistence is how access survives over time, and command-and-control, or C2, is how an attacker communicates with compromised systems. Understanding these concepts matters chiefly for defense and for testing an organization's detection. In an authorized engagement, any persistence is carefully documented and removed, and the real value lies in teaching defenders exactly what signals to watch for.
Analogy🏏Cricket
🏏 Think of it like cricket: Active recon is the captain walking out to inspect the pitch on match morning, pressing the surface, checking the grass, watching how the ball behaves in the nets. Unlike studying old footage from afar, this inspection happens on the ground itself and is visible to everyone. Just as that inspection reveals conditions no video could, active scanning reveals live services no public record shows, and just as it happens with the ground's permission, scanning happens only within authorized scope.