Every intrusion that lasts longer than one session needs a way for the operator to talk to compromised systems, and the Command and Control tactic (TA0011) catalogues the ways adversaries keep that channel open while blending into normal traffic. MITRE ATT&CK v20 describes the tactic as the adversary "trying to communicate with compromised systems to control them", and notes that adversaries "commonly attempt to mimic normal, expected traffic". This hub covers all 18 techniques and 27 sub-techniques: which ones dominate real procedure data, how campaigns layer them, why trusted SaaS services, remote access tools and tunnels are now the hardest cases, and where detection and egress control pay back first. It links to each technique guide rather than repeating it and is written for network security engineers, detection engineers and threat hunters. For the discipline overview see the Command and Control (C2) Guide; for beacon analytics in depth see the Beaconing and C2 Detection Guide.
Key takeaways
- C2 is the busiest tactic in the procedure data. ATT&CK v20 records 2,386 procedure uses across the 45 C2 entries, led by Web Protocols (T1071.001, 431 records) and Ingress Tool Transfer (T1105, 531).
- Most C2 hides inside HTTPS. Web Protocols, Encrypted Channel (T1573, 301 records) and Standard Encoding (T1132.001, 131) are among the most recorded entries, so content signatures alone see little.
- Trusted services are the hard cases. Web Service C2 (T1102, 144 records), remote access tools (T1219) and tunnels such as ngrok or Cloudflare Tunnel (T1572) use domains and software your organisation already allows.
- Network intrusion prevention dominates the mitigation map. In v20, M1031 Network Intrusion Prevention maps to 32 of the 45 entries and M1037 Filter Network Traffic to 16; endpoint and application controls close the gaps.
- Join process to connection. The v20 detection strategies almost all pair a network event (Sysmon Event IDs 3 and 22, Zeek logs) with the process that made it; a beacon from rundll32.exe means far more than a beacon from a browser.
What the tactic covers and how the numbers were counted
Command and Control is about the channel, not the payload. It spans the protocol carrying commands, how traffic is encoded, encrypted or disguised, how infrastructure is located and hidden, and how tools are pulled into the network. The figures here come from the ATT&CK v20.0 Enterprise STIX bundle: every technique and sub-technique with the command-and-control phase (revoked and deprecated excluded), and every "uses" relationship from groups, software and campaigns. That gives 45 entries (18 techniques, 27 sub-techniques) and 2,386 procedure records from 132 groups, 613 software entries and 50 campaigns. Most records come from malware entries, so the counts describe how implants talk rather than how often each channel is seen on a given network.
Every technique in the tactic
Grouped by what the technique does to the channel. Record counts are family totals.
| Group | Technique | Sub-techniques | Procedure records |
|---|---|---|---|
| Channel protocol | T1071 Application Layer Protocol | .001 Web Protocols, .002 File Transfer Protocols, .003 Mail Protocols, .004 DNS, .005 Publish/Subscribe Protocols | 559 |
| T1095 Non-Application Layer Protocol | None | 109 | |
| T1571 Non-Standard Port | None | 68 | |
| T1092 Communication Through Removable Media | None | 3 | |
| Trusted services and tools | T1102 Web Service | .001 Dead Drop Resolver, .002 Bidirectional Communication, .003 One-Way Communication | 144 |
| T1219 Remote Access Tools | .001 IDE Tunneling, .002 Remote Desktop Software, .003 Remote Access Hardware | 41 | |
| T1105 Ingress Tool Transfer | None | 531 | |
| Hiding the content | T1573 Encrypted Channel | .001 Symmetric Cryptography, .002 Asymmetric Cryptography | 301 |
| T1132 Data Encoding | .001 Standard Encoding, .002 Non-Standard Encoding | 157 | |
| T1001 Data Obfuscation | .001 Junk Data, .002 Steganography, .003 Protocol or Service Impersonation | 69 | |
| T1572 Protocol Tunneling | None | 44 | |
| Routing and infrastructure | T1090 Proxy | .001 Internal Proxy, .002 External Proxy, .003 Multi-hop Proxy, .004 Domain Fronting | 189 |
| T1568 Dynamic Resolution | .001 Fast Flux DNS, .002 Domain Generation Algorithms, .003 DNS Calculation | 55 | |
| T1665 Hide Infrastructure | None | 8 | |
| T1659 Content Injection | None | 2 | |
| Resilience and activation | T1008 Fallback Channels | None | 58 |
| T1104 Multi-Stage Channels | None | 15 | |
| T1205 Traffic Signaling | .001 Port Knocking, .002 Socket Filters | 33 |
T1205 Traffic Signaling also sits under Persistence and Stealth, and T1659 Content Injection under Initial Access; all other C2 techniques belong to this tactic alone.
Where to start: ranked techniques for defenders
- T1105 Ingress Tool Transfer: the most recorded single technique and the moment a foothold becomes an operation. A non-browser process writing an executable straight after an outbound connection is a strong, cheap signal (Sysmon Event IDs 3, 11 and 1 in DET0060).
- T1071.001 Web Protocols with T1573: where most implants live. Detection depends on process context, destination age and reputation, and timing regularity, not payload inspection.
- T1219 Remote Access Tools: AnyDesk, ScreenConnect and similar tools give hands-on-keyboard C2 that looks like IT support. CISA advisory AA23-025A (January 2023) describes actors running them as portable executables that need no installation or administrator rights. Allowlist the one approved tool and block the rest. See Detecting RustDesk, MeshCentral and Tactical RMM Abuse.
- T1572 Protocol Tunneling and T1090 Proxy: SSH, DNS and HTTPS tunnels and reverse proxies carry RDP and SMB out of the network. Watch for tunnelling clients and for egress from servers that should never initiate it. See Cloudflare Tunnel and trycloudflare abuse.
- T1102 Web Service: C2 over cloud storage, code hosting, chat and social platforms. Domain blocking fails; detect by which process talks to the service and how much it uploads.
- T1071.004 DNS and T1568 Dynamic Resolution: lower volume but visible in resolver logs: long, high-entropy subdomains, high NXDOMAIN rates and DGA patterns. See the DNS Logging and Detection Guide.
- T1205 Traffic Signaling and T1665 Hide Infrastructure: rarer, used against edge devices and by state actors; covered best by edge device integrity checks and threat intelligence rather than generic analytics.
How campaigns layer C2
ATT&CK v20 maps 50 campaigns to this tactic. No serious operation uses one channel; they combine a primary channel, a fallback and a way to bring in tools.
- SolarWinds Compromise (C0024): APT29 used HTTP for C2 and data exfiltration (T1071.001), dynamic DNS resolution to build and resolve randomly generated subdomains (T1568), hostnames on its C2 infrastructure set to match legitimate hostnames in the victim environment and IP addresses from the victim's own country (T1665), SSH port forwarding on public-facing systems (T1090.001), and downloaded TEARDROP and Cobalt Strike (T1105). The lesson: infrastructure built to look local defeats geolocation and reputation rules. See the SolarWinds supply chain compromise.
- Scattered Spider (G1015) and C0027: ATT&CK records the group deploying RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok and ConnectWise (T1219.002), directing victims to run RMM tools, installing tunnelling tools on VMware vCenter and adversary-controlled VMs including Chisel configured for trycloudflare subdomains, ngrok, Pinggy and Teleport (T1572), using SSH tunnelling, an rsocx reverse proxy on an ESXi appliance (T1090) and downloading tools from file.io, GitHub and paste.ee (T1102). Every one of these is a legitimate service.
- Volt Typhoon (G1017): multi-hop proxies for C2 (T1090.003), the built-in netsh port proxy command to relay traffic (T1090.001), compromised devices with FRP and Earthworm as proxies, and an AES-encrypted web shell channel (T1573.001). Living off the land extends to the network.
- Cutting Edge (C0029): after exploiting Ivanti Connect Secure, actors used DNS to tunnel IPv4 C2 traffic with Iodine (T1071.004, T1572), a Unix socket and reverse TCP shell (T1095) and a magic 48-byte sequence to activate the PITSOCK backdoor (T1205). C2 that lives on the edge appliance never crosses an internal sensor. The Ivanti Connect Secure exploitation page covers the credential theft that followed.
Trusted site C2 and where identity fits
When C2 runs through a SaaS platform, the channel is authenticated with an API token, OAuth grant or account the adversary controls, and sometimes with one stolen from the victim. Three practical consequences follow. First, tenant restrictions and conditional access can limit which tenants and accounts a managed device may reach on a shared service, which domain blocking cannot. Second, tokens and bot credentials for collaboration tools used by internal automation are attractive to adversaries because their traffic is already expected; scope and rotate them like any other secret, as described in the Secrets Management Guide. Third, remote access tools are identities too: an approved RMM platform with a weak administrator login is C2 the adversary does not need to build. See the RMM Tool Security Guide.
Detection priorities across the tactic
| Technique | v20 detection strategy | Log sources named | What to alert on |
|---|---|---|---|
| T1105 Ingress Tool Transfer | DET0060 | Sysmon Event IDs 1, 3, 11, 22; auditd connect, execve, write | Executable or script written by a non-browser process right after an external connection |
| T1071.001 Web Protocols | DET0027 | Zeek http.log and ssl.log; Sysmon Event IDs 3 and 22 | Regular-interval HTTPS from rundll32, PowerShell or unsigned binaries to young or rare domains |
| T1071.004 DNS | DET0400 | Zeek dns.log; Sysmon Event IDs 3 and 22 | Long or high-entropy subdomains and high query volume from non-browser processes |
| T1568.002 Domain Generation Algorithms | DET0419 | Sysmon Event IDs 3 and 22, Security Event ID 4688; resolver logs | Bursts of NXDOMAIN responses for random-looking names |
| T1102.002 Bidirectional Web Service | DET0035 | Sysmon Event IDs 1, 3, 22; WinINet ETW; Zeek conn.log and ssl.log | Scripted or non-interactive processes uploading to storage, paste or social sites |
| T1219.002 Remote Desktop Software | DET0259 | Sysmon Event IDs 3, 11, 22; Windows Firewall rule changes | Any RMM binary other than the approved one, including portable executables |
| T1572 Protocol Tunneling | DET0538 | Sysmon Event IDs 1, 3, 22; auditd socket calls; sshd logs | plink, ssh with forwarding flags, chisel-like clients, or netsh port proxy on servers |
| T1090.003 Multi-hop Proxy | DET0359 | Sysmon Event IDs 1, 3, 22; DNS queries for .onion names; firewall logs | Tor or relay clients and sustained encrypted sessions to anonymity infrastructure |
| T1571 Non-Standard Port | DET0227 | Security Event IDs 5156 and 5157; Sysmon Event ID 1 | Protocol and port mismatches, such as TLS on high ports from system processes |
Metrics that show it is working
- Egress default: share of server subnets with default-deny outbound and an explicit allow list.
- DNS visibility: share of endpoints whose DNS goes through the logged, protective resolver rather than direct to the internet or over unmanaged DNS over HTTPS.
- Unapproved RMM: number of hosts running remote access software other than the approved tool, trending to zero.
- Process attribution: share of outbound connections in the SIEM that carry a process name and hash.
- Emulation pass rate: share of C2 emulation tests (HTTPS beacon, DNS tunnel, RMM install, SSH reverse tunnel) detected within one hour.
Mitigation priorities
| Mitigation | Entries mapped in TA0011 | Practical form |
|---|---|---|
| M1031 Network Intrusion Prevention | 32 | IDS/IPS and NDR signatures for known C2 frameworks and protocol anomalies. See the NDR Guide. |
| M1037 Filter Network Traffic | 16 | Default-deny egress for servers, forced proxy for workstations, block direct outbound DNS. See Cloud Egress Filtering. |
| M1021 Restrict Web-Based Content | 7 | Category and newly registered domain blocking at the secure web gateway. See the Secure Web Gateway and Web Filtering Guide. |
| M1020 SSL/TLS Inspection | 4 | Selective inspection where privacy and law allow. See the TLS Inspection Guide. |
| M1042 Disable or Remove Feature or Program | 4 | Remove unapproved remote access and tunnelling tools |
| M1038 Execution Prevention | 3 | Application control that blocks portable RMM and tunnelling binaries, as CISA AA23-025A recommends |
The mapping leans heavily on network controls, which encrypted and trusted-service C2 increasingly bypasses. Pair it with endpoint telemetry that ties connections to processes. For the full mitigation catalogue see the ATT&CK Mitigations hub.
Phased rollout
- Get process-attributed network data: Sysmon Event IDs 3 and 22 (or EDR equivalents) on endpoints and servers, plus Zeek or firewall logs at egress.
- Centralise DNS: force resolution through a logged protective resolver and block outbound port 53 from everything else.
- Pick one RMM tool: allowlist it by publisher, block the rest in audit mode first, review hits with IT, then enforce; keep a rollback rule per device group.
- Default-deny server egress: start with domain controllers and other tier 0 servers, log drops for two weeks, then enforce ring by ring.
- Add beacon and tunnel analytics: timing regularity, rare destinations, and tunnelling client execution, tuned against the baselines from step 1.
- Test quarterly: run C2 emulation across HTTPS, DNS, web service, RMM and SSH tunnel channels.
Decision guidance
- TLS inspection or not: inspection helps for workstation web traffic but breaks pinned applications and raises privacy issues; process and destination analytics on uninspected traffic often give similar detection value at lower cost.
- Small organisations: a protective DNS service, a single approved RMM tool with application control, and EDR with network telemetry cover the most common channels.
- Large organisations: NDR at internal choke points pays back for tunnels and internal proxies (T1090.001) that perimeter controls never see.
Common failure patterns
- Allow by reputation: trusting traffic to well-known cloud and SaaS domains, which is exactly where T1102 and tunnel services operate.
- Several RMM tools tolerated: once IT uses three remote access products, a fourth installed by an adversary does not stand out.
- Servers with open egress: domain controllers and databases that can reach the internet directly give implants an easy path.
- DNS outside the resolver: direct outbound DNS or unmanaged DNS over HTTPS removes visibility of tunnelling and DGA activity.
- No process on network logs: beacon analytics fire on browsers and updaters, analysts tune them off, and real implants slip through.
- Edge appliances unmonitored: C2 on VPN and firewall appliances, as in Cutting Edge, never touches the EDR estate.
Framework mapping
| Framework | Relevant references |
|---|---|
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection, SC-7(5) Deny by Default, Allow by Exception, SI-4 System Monitoring, SI-4(4) Inbound and Outbound Communications Traffic, CM-7 Least Functionality, CA-7 Continuous Monitoring |
| NIST CSF 2.0 | PR.IR-01 networks protected from unauthorised logical access, DE.CM-01 networks monitored, DE.CM-09 computing environments monitored |
| CIS Controls v8.1 | Control 2 Inventory and Control of Software Assets, Control 9 Email and Web Browser Protections, Control 13 Network Monitoring and Defense |
| MITRE D3FEND | D3-NTA Network Traffic Analysis, D3-OTF Outbound Traffic Filtering, D3-DNSDL DNS Denylisting, D3-NTF Network Traffic Filtering |
Practitioner checklist
- Collect process-attributed network telemetry from every endpoint and server.
- Force DNS through a logged protective resolver and block other outbound DNS.
- Approve one remote access tool, block portable and unapproved RMM binaries, and alert on any attempt.
- Apply default-deny egress to tier 0 and server subnets.
- Alert on executables written right after outbound connections by non-browser processes.
- Hunt for tunnelling clients, SSH forwarding and netsh port proxy rules on servers.
- Restrict which tenants managed devices can reach on shared SaaS platforms where the platform supports it.
- Monitor edge appliances for integrity and unexpected outbound connections.
- Run quarterly C2 emulation across at least five channel types and track the detection rate.
Standards and references
- MITRE ATT&CK: Command and Control (TA0011)
- MITRE ATT&CK: Scattered Spider (G1015)
- MITRE ATT&CK: Volt Typhoon (G1017)
- MITRE ATT&CK: Cutting Edge (C0029)
- CISA: Protecting Against Malicious Use of Remote Monitoring and Management Software (AA23-025A)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- MITRE D3FEND: Knowledge graph
Related NHI Mgmt Group resources: Command and Control (C2) Guide · Beaconing and C2 Detection Guide · DNS Logging and Detection Guide · Unauthorised Remote Monitoring and Management Tool Playbook · ATT&CK Mitigations