Command and Control

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

Detect it with
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Detect it with
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

HTTP, HTTPS, DNS, and mail protocols carrying command traffic inside ordinary-looking sessions.

Detect it with
Beaconing intervals with low jitter, uniform payload sizes, long-lived connections to rare destinations.

Multi-hop proxies, Tor, and domain fronting used to hide the true C2 destination.

Detect it with
Tor entry-node connections; internal hosts acting as relays for other internal hosts.

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.

Detect it with
Monitor file access on removable media. Detect processes that execute when removable media is mounted.

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.

Detect it with
Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

Detect it with
Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption.

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

Detect it with
Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure.

Pulling additional tooling into the environment after the initial payload lands.

Detect it with
certutil -urlcache, bitsadmin, curl, and PowerShell downloads writing executables to disk.

Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system.

Detect it with
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

Detect it with
Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows. The Wake-on-LAN magic packet consists of 6 bytes of FF followed by sixteen repetitions of the target system's IEEE address.

AnyDesk, TeamViewer, ScreenConnect, and similar tools installed by the adversary as their C2.

Detect it with
RMM binaries on hosts outside IT's approved inventory; traffic to RMM vendor domains from unmanaged endpoints.

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

Detect it with
Detecting dynamically generated C2 can be challenging due to the number of different algorithms, constantly evolving malware families, and the increasing complexity of the algorithms.

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443.

Detect it with
Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.

Detect it with
Monitoring for systems listening and/or establishing external connections using ports/protocols commonly associated with tunneling, such as SSH (port 22). Also monitor for processes commonly associated with tunneling, such as Plink and the OpenSSH client.

TLS or custom crypto wrapping the C2 channel so content inspection sees nothing.

Detect it with
JA3/JA3S fingerprints, self-signed certificates, TLS to IP addresses with no SNI.

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.