MITRE ATT&CK — Command & Control (Full Mapping)

CyberDefender 9 mins0

MITRE ATT&CK — Command & Control (Full Mapping)

Table of contents

  1. Executive summary
  2. Full C2 technique matrix (TA0011) — techniques & sub-techniques
  3. Example malware C2 mapping — Cobalt Strike / generic RAT (sample mapping)
  4. Incident scenario mapping — Phishing -> Intrusion -> C2 -> Data theft
  5. Detection & telemetry mapping (network, host, cloud, endpoints)
  6. Mitigations and controls mapped to techniques

1) Executive summary

This document focuses on Command and Control (C2) as defined by MITRE ATT&CK (TA0011). It lists the primary techniques used by adversaries to establish, maintain, and hide communications with compromised systems; shows how those techniques map to a real-world C2 framework (example: Cobalt Strike / Beacon-style); provides an incident-level mapping showing how C2 fits into an intrusion lifecycle; and gives detection, telemetry and mitigation recommendations.

2) Full C2 technique matrix (TA0011)

Below are the ATT&CK techniques and (where applicable) sub-techniques typically associated with the Command and Control tactic. Each entry includes a short description and common signs/indicators.

Note: The above table focuses on techniques that implement C2 and the infrastructure and behaviors attackers use to keep communications alive.

3) Example malware C2 mapping — Cobalt Strike / Generic Beacon-like RAT

Below is a sample mapping for a generic beaconing RAT similar to Cobalt Strike. This is an illustrative mapping you can adapt to a particular sample by replacing indicators and IOCs.

Sample characteristics (generic):

  • Periodic HTTPS beacon (randomized intervals)
  • Uses POST to /submit and GET to /task endpoints
  • Tasks encoded in base64 and may be AES-encrypted
  • Implements fallback domains + embedded IP list
  • Supports file upload/download, port forwarding, and interactive shells

Mapping

  • Initial C2 channel: T1071.001 (Web Protocols) + T1573 (Encrypted Channel)
  • Beaconing pattern: Observed periodic outbound POSTs (Network detection: beaconing analysis)
  • Fallback & rotation: DGAs / domain rotation (Infrastructure technique)
  • File transfer / stage: T1105 (Ingress Tool Transfer) via HTTPS
  • Obfuscation: T1001.003 (Protocol Impersonation) — HTTP headers mimic common browsers
  • Proxying / pivoting: T1090 (Proxy) when the RAT config uses internal relays
  • Use of legitimate cloud: If beacon checks GitHub for tasking -> T1102 (Web Service)

Telemetry to collect for a sample:

  • Process name, PID, parent process, command line
  • Network connections (remote IP, remote domain, local port)
  • TLS fingerprints (JA3/JA3S), SNI values, HTTP headers, URI patterns
  • Files written to disk and hashes
  • DNS query patterns (labels, frequency, response size)
  • Scheduled tasks/registry run keys (persistence)

Sample Hunting Queries (examples)

  • Network: “Find hosts with periodic POSTs to domains with low reputation and POST body > 512 bytes”.
  • DNS: “Find hosts making repeated TXT queries or long label queries to external domains”.
  • Endpoint: “Processes making encrypted outbound connections where parent process is a user app (e.g., explorer.exe) and child code not signed.”

4) Incident scenario mapping — Phishing -> Credential theft -> C2 -> Data exfiltration

Scenario summary (steps):

  1. Phishing email with malicious attachment (macro) — initial access (T1566)
  2. Macro downloads a payload (T1204 -> T1105) and executes a loader
  3. Loader writes a beaconing RAT that beacons to attacker C2 over HTTPS (T1071.001 + T1573)
  4. RAT enumerates files and lives on host. It uses scheduled tasks to maintain persistence
  5. Attacker issues commands to collect and compress sensitive files, then uses DNS tunneling as fallback C2 if HTTPS is blocked (T1071.004)
  6. Data exfil via encrypted POSTs to attacker endpoint (T1071.001) or via DNS exfil (T1071.004)

Mapping (MITRE technique IDs attached to steps):

  • Phishing: T1566 (Phishing)
  • User execution: T1204 (User Execution)
  • Download/Install: T1105 (Ingress Tool Transfer)
  • Beaconing C2: T1071.001 (Web Protocols) + T1573 (Encrypted Channel)
  • DNS fallback/tunneling: T1071.004 (DNS)
  • Persistence: (e.g., T1053 scheduled task, T1547 service)
  • Exfiltration: T1041 (Exfil over C2 channel) or T1071.004 if DNS exfil

Detection opportunities per phase:

  • Email gateway logging + attachment detonation (phishing detection)
  • Host payload writes, unusual child processes, new scheduled tasks
  • Outbound beaconing patterns from endpoint network logs
  • High-entropy DNS labels and many NXDOMAINs for DGA-style fallback
  • Data transfer anomalies: large POST bodies to rare external endpoints

5) Detection & telemetry mapping

Group telemetry and detection controls by source.

Network telemetry

  • DNS logs: Query frequency, label entropy, NXDOMAIN rate, TXT sizes
  • Proxy/HTTP logs: URI patterns, SNI, POST sizes, user-agent anomalies, domain reputation
  • TLS fingerprints: JA3/JA3S; mismatches between certificate details and domain
  • Netflow / IP logs: Long-lived connections to unusual endpoints; multi-hop patterns

Host telemetry

  • Process creation logs: Parent-child mapping, unusual parent process (e.g., Word -> PowerShell -> net.exe)
  • File system: New binaries in user temp, hidden directories, suspicious file hashes
  • Registry / scheduled tasks: Persistence artifacts
  • Memory: In-memory-only loaders, suspicious handle of network sockets

Cloud/SaaS telemetry

  • API calls: Unusual calls to GitHub, Pastebin, or cloud storage with encoded payloads
  • Service logs: New OAuth app authorizations, unusual app-scoped tokens

Detection signatures & behavioural detections

  • Beacon detection: Periodicity analysis, pulse-detection algorithms
  • DNS tunneling detectors: Entropy, uncommon record types, long labels
  • TLS abnormality: JA3 mismatches, odd cipher suites, self-signed certs for public domains
  • User-initiated remote tools: Presence of remote access software with no ticketing/approval

6) Mitigations and controls mapped to techniques

Use the ATT&CK mitigation controls and map them to the specific techniques shown above.

Control / Mitigation Techniques addressed
Network segmentation and least-privilege egress controls (allowlist outbound) T1071.*, T1090, T1102
TLS inspection and proxying (with privacy considerations) T1573, T1071.

 

CyberDefender