TA0011 Command and Control

The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.

View in MITRE ATT&CK®

ATT&CK Techniques

Technique ID Technique Name Number of Mappings Number of Subtechniques
T1071 Application Layer Protocol 38 5
T1219 Remote Access Software 25 0
T1659 Content Injection 12 0
T1205 Traffic Signaling 19 2
T1572 Protocol Tunneling 26 0
T1092 Communication Through Removable Media 14 0
T1090 Proxy 30 4
T1568 Dynamic Resolution 20 3
T1102 Web Service 17 3
T1104 Multi-Stage Channels 17 0
T1001 Data Obfuscation 12 3
T1571 Non-Standard Port 24 0
T1573 Encrypted Channel 20 2
T1095 Non-Application Layer Protocol 29 0
T1132 Data Encoding 13 2
T1105 Ingress Tool Transfer 21 0
T1665 Hide Infrastructure 2 0
T1008 Fallback Channels 20 0