Cyber Wiki Learning Path
MITRE ATT&CK®: Command and Control
Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Command and Control objective, with defensive explanations and linked BMC learning resources.
Recommended Sequence
45 connected entries
Application Layer Protocol (T1071)
An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.
ATT&CK sub-technique profile · AdvancedAsymmetric Cryptography (T1573.002)
Asymmetric Cryptography (T1573.002) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedBidirectional Communication (T1102.002)
Bidirectional Communication (T1102.002) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateCommunication Through Removable Media (T1092)
Communication Through Removable Media (T1092) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateContent Injection (T1659)
Content Injection (T1659) is an Enterprise ATT&CK technique associated with Initial Access, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedDNS (T1071.004)
DNS (T1071.004) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedDNS Calculation (T1568.003)
DNS Calculation (T1568.003) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateData Encoding (T1132)
Data Encoding (T1132) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateData Obfuscation (T1001)
Data Obfuscation (T1001) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedDead Drop Resolver (T1102.001)
Dead Drop Resolver (T1102.001) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedDomain Fronting (T1090.004)
Domain Fronting (T1090.004) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedDomain Generation Algorithms (T1568.002)
Domain Generation Algorithms (T1568.002) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateDynamic Resolution (T1568)
Dynamic Resolution (T1568) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateEncrypted Channel (T1573)
An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.
ATT&CK sub-technique profile · AdvancedExternal Proxy (T1090.002)
External Proxy (T1090.002) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateFallback Channels (T1008)
Fallback Channels (T1008) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedFast Flux DNS (T1568.001)
Fast Flux DNS (T1568.001) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedFile Transfer Protocols (T1071.002)
File Transfer Protocols (T1071.002) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateHide Infrastructure (T1665)
Hide Infrastructure (T1665) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedIDE Tunneling (T1219.001)
IDE Tunneling (T1219.001) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateIngress Tool Transfer (T1105)
An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.
ATT&CK sub-technique profile · AdvancedInternal Proxy (T1090.001)
Internal Proxy (T1090.001) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedJunk Data (T1001.001)
Junk Data (T1001.001) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedMail Protocols (T1071.003)
Mail Protocols (T1071.003) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateMulti-Stage Channels (T1104)
Multi-Stage Channels (T1104) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedMulti-hop Proxy (T1090.003)
Multi-hop Proxy (T1090.003) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateNon-Application Layer Protocol (T1095)
Non-Application Layer Protocol (T1095) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedNon-Standard Encoding (T1132.002)
Non-Standard Encoding (T1132.002) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateNon-Standard Port (T1571)
Non-Standard Port (T1571) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedOne-Way Communication (T1102.003)
One-Way Communication (T1102.003) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedPort Knocking (T1205.001)
Port Knocking (T1205.001) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.
ATT&CK technique profile · IntermediateProtocol Tunneling (T1572)
Protocol Tunneling (T1572) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedProtocol or Service Impersonation (T1001.003)
Protocol or Service Impersonation (T1001.003) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateProxy (T1090)
Proxy (T1090) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedPublish/Subscribe Protocols (T1071.005)
Publish/Subscribe Protocols (T1071.005) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedRemote Access Hardware (T1219.003)
Remote Access Hardware (T1219.003) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateRemote Access Tools (T1219)
Remote Access Tools (T1219) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedRemote Desktop Software (T1219.002)
Remote Desktop Software (T1219.002) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedSocket Filters (T1205.002)
Socket Filters (T1205.002) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.
ATT&CK sub-technique profile · AdvancedStandard Encoding (T1132.001)
Standard Encoding (T1132.001) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedSteganography (T1001.002)
Steganography (T1001.002) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK sub-technique profile · AdvancedSymmetric Cryptography (T1573.001)
Symmetric Cryptography (T1573.001) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateTraffic Signaling (T1205)
Traffic Signaling (T1205) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedWeb Protocols (T1071.001)
Web Protocols (T1071.001) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
ATT&CK technique profile · IntermediateWeb Service (T1102)
Web Service (T1102) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.