T1102.002 · threatengine.sh

Home/ATT&CK Technique/Bidirectional Communication

ATT&CK Technique

Bidirectional Communication

T1102.002 · command-and-control

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel.

The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.

Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

ESXiLinuxmacOSWindows

◆

Actors Using This

14

north_koreaAndariel
chinaAoqin Dragon
chinaAPT10
chinaAPT17
russiaAPT28
chinaAPT31
iranAPT33
iranOilRig
iranAPT35
north_koreaAPT37
north_koreaAPT38
chinaAPT3
chinaAPT40
private_mercenaryBahamut

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

reconnaissance earlier

T1598.002 · Spearphishing Attachment ×3.72 T1589.002 · Email Addresses ×3.23

resource-development earlier

T1583.002 · DNS Server ×3.72 T1584.006 · Web Services ×3.35

persistence earlier

T1137.006 · Add-ins ×3.72 T1137 · Office Application Startup ×3.19

privilege-escalation earlier

T1546.011 · Application Shimming ×3.72 T1546.015 · Component Object Model Hijacking ×3.72 T1546.001 · Change Default File Association ×3.41

credential-access earlier

T1552.002 · Credentials in Registry ×3.72 T1555.004 · Windows Credential Manager ×3.25

command-and-control same

T1102.001 · Dead Drop Resolver ×3.31 T1071.003 · Mail Protocols ×3.27

other same

T1027.011 · Fileless Storage ×3.72 T1564.003 · Hidden Window ×3.19

▣

Mitigations

2

MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.

M1021Restrict Web-Based Content

Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery.

Deploy Web Proxy Filtering

Use solutions to filter web traffic based on categories, reputation, and content types.
Enforce policies that block unsafe websites or file types at the gateway level.

Enable DNS-Based Filtering

Implement tools to restrict access to domains associated with malware or phishing campaigns.
Use public DNS filtering services to enhance protection.

Enforce Content Security Policies (CSP)

Configure CSP headers on internal and external web applications to restrict script execution, iframe embedding, and cross-origin requests.

Control Browser Features

Disable unapproved browser features like automatic downloads, developer tools, or unsafe scripting.
Enforce policies through tools like Group Policy Management to control browser settings.

Monitor and Alert on Web-Based Threats

Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.
Configure alerts for access attempts to blocked domains or repeated file download failures.

M1031Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

◈

Detection Coverage

1/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) 3

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) none

Vuln scan (Nuclei) none

▣

Comply & Defend

NIST 800-53AC-04, CA-07, CM-02, CM-06, CM-07, SC-07, SI-03, SI-04

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin