TA0011 · COMMAND AND CONTROL
Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.
Detect it with
Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption.
Why it matters on shift
Bidirectional Communication is one of the concrete ways adversaries achieve command and control. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After command and control, the next tactic is usually Exfiltration. Search your telemetry for the transition before closing the ticket.
Kill-chain context