TA0011 Command and Control Mappings

The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.

View in MITRE ATT&CK®

ATT&CK Techniques

Technique ID Technique Name Number of Mappings Number of Subtechniques
T1071 Application Layer Protocol 15 4
T1092 Communication Through Removable Media 8 0
T1132 Data Encoding 7 2
T1001 Data Obfuscation 7 3
T1568 Dynamic Resolution 8 1
T1573 Encrypted Channel 11 2
T1008 Fallback Channels 8 0
T1105 Ingress Tool Transfer 8 0
T1104 Multi-Stage Channels 8 0
T1095 Non-Application Layer Protocol 11 0
T1571 Non-Standard Port 8 0
T1572 Protocol Tunneling 11 0
T1090 Proxy 12 4
T1219 Remote Access Software 13 0
T1205 Traffic Signaling 9 1
T1102 Web Service 8 3