MITRE ATT&CKtactic
TA0011 Command and Control
- Domain
- enterprise
- Version
- 1.0
- Created
- 2018-10-17
Description
The adversary is trying to communicate with compromised systems to control them.
Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
Related
Referenced by MITRE ATT&CK · tactic (45)
- T1219.003 Remote Access Hardware sub-technique
- T1219.002 Remote Desktop Software sub-technique
- T1219.001 IDE Tunneling sub-technique
- T1071.005 Publish/Subscribe Protocols sub-technique
- T1665 Hide Infrastructure technique
- T1659 Content Injection technique
- T1205.002 Socket Filters sub-technique
- T1205.001 Port Knocking sub-technique
- T1573 Encrypted Channel technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1001.001 Junk Data sub-technique
- T1001.002 Steganography sub-technique
- T1001.003 Protocol or Service Impersonation sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.002 File Transfer Protocols sub-technique
- T1071.003 Mail Protocols sub-technique
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1090.001 Internal Proxy sub-technique
- T1090.002 External Proxy sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1090.004 Domain Fronting sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1102.003 One-Way Communication sub-technique
- T1132.001 Standard Encoding sub-technique
- T1132.002 Non-Standard Encoding sub-technique
- T1571 Non-Standard Port technique
- T1568.001 Fast Flux DNS sub-technique