TA0011 / Enterprise tactic
Command and Control
Official MITRE tacticThe adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
18 techniques
- T1071Application Layer Protocol5 sub-techniques
- T1092Communication Through Removable Media
- T1659Content Injection
- T1132Data Encoding2 sub-techniques
- T1001Data Obfuscation3 sub-techniques
- T1568Dynamic Resolution3 sub-techniques
- T1573Encrypted Channel2 sub-techniques
- T1008Fallback Channels
- T1665Hide Infrastructure
- T1105Ingress Tool Transfer
- T1104Multi-Stage Channels
- T1095Non-Application Layer Protocol
- T1571Non-Standard Port
- T1572Protocol Tunneling
- T1090Proxy4 sub-techniques
- T1219Remote Access Tools3 sub-techniques
- T1205Traffic Signaling2 sub-techniques
- T1102Web Service3 sub-techniques