Command & Control Techniques

Master command and control techniques for red team operations. Learn to establish persistent communication channels and maintain remote access.

6 Techniques

MITRE ATT&CK

45 min read

Command & Control Techniques

T1071

Intermediate

Application Layer Protocol

Use common application protocols for command and control communication

Tools

HTTP/HTTPS

DNS

FTP

SMTP

Steps

1.Select appropriate application protocol for C2
2.Configure C2 server with chosen protocol
3.Deploy agents with protocol communication
+2 more steps...

T1573

Advanced

Encrypted Channel

Encrypt C2 communications to evade network monitoring

Tools

TLS/SSL

Custom Encryption

VPN

Tor

Steps

1.Implement strong encryption algorithms
2.Generate and manage encryption keys
3.Establish secure communication channels
+2 more steps...

T1090

Advanced

Proxy

Use proxy servers to hide C2 infrastructure and communications

Tools

HTTP Proxies

SOCKS Proxies

Domain Fronting

CDN

Steps

1.Set up proxy infrastructure
2.Configure agents to use proxy chains
3.Implement domain fronting techniques
+2 more steps...

T1102

Intermediate

Web Service

Use legitimate web services for command and control

Tools

Social Media

Cloud Storage

Pastebin

GitHub

Steps

1.Identify suitable web services for C2
2.Create accounts on target platforms
3.Develop communication protocols
+2 more steps...

T1132

Intermediate

Data Encoding

Encode C2 communications to evade detection

Tools

Base64

XOR

Custom Encoding

Steganography

Steps

1.Select appropriate encoding methods
2.Implement encoding/decoding functions
3.Test encoding effectiveness against detection
+2 more steps...

T1105

Beginner

Ingress Tool Transfer

Transfer tools and files from external systems

Tools

PowerShell

Wget

Curl

FTP

Steps

1.Identify file transfer requirements
2.Select appropriate transfer methods
3.Establish secure transfer channels
+2 more steps...

Essential Tools

Cobalt Strike

★

C2 Framework

Commercial C2 framework with advanced capabilities

Empire

★

C2 Framework

PowerShell-based post-exploitation framework

Metasploit

★

Framework

Penetration testing framework with C2 capabilities

Covenant

★

C2 Framework

.NET command and control framework

PoshC2

★

C2 Framework

PowerShell C2 framework with proxy capabilities

Sliver

★

C2 Framework

Open source C2 framework written in Go

Defense & Mitigations

Implement these security measures to defend against command and control attacks

Implement network monitoring and traffic analysis

Use application layer firewalls and DPI

Monitor for unusual outbound connections

Implement certificate pinning and validation

Use endpoint detection and response (EDR)

Regular threat hunting activities