For enterprise networks, you can still analyze the pattern of packets to match fingerprints of C2 traffic. There are solutions such as Cisco's Encrypted Traffic Analytics, that do just this: https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Camp...

> How is a defender suppose to detect this traffic?

Probably by taking a decentralized approach, that's probably more secure, performant and better to maintain anyways. Also on the server side one could do TLS using Haproxy or nginx, this way it would even be possible to use existing tools - just on localhost though. Or, one can do TLS re-encryption with Haproxy/nginx (or Squid for the other direction), and do checking on the host at the same time.

Tools like JA3 https://github.com/salesforce/ja3 can fingerprint TLS traffic to provide one way to perform some type of evaluation. Defender can detect on a lot of other things like an applications behavior.

That can be trivially defeated by operating on top of Chrome's net stack though.

Most modern implants dont directly talk to a C2, they relay over other protocols like pastebin, twitter, or blog storage pictures, or databases to obscure traffic.