Command and Control
- ID
- TA0011
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
The adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
Techniques (18)
- T1071 Application Layer Protocol
- T1092 Communication Through Removable Media
- T1659 Content Injection
- T1132 Data Encoding
- T1001 Data Obfuscation
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1008 Fallback Channels
- T1665 Hide Infrastructure
- T1105 Ingress Tool Transfer
- T1104 Multi-Stage Channels
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1090 Proxy
- T1219 Remote Access Tools
- T1205 Traffic Signaling
- T1102 Web Service
