The MITRE ATT&CK™ for Enterprise

SO
11.-Command & Control OTA UPDATES

1 2 3 4 5 6 7 8 9 10 11
Initial Privilege Defense Credential Lateral Command
Execution Persistence Discovery Collection Exfiltration
Access Escalation Evasion Access Movement &
Control

Command & Control

• Commonly Used Port • Multiband Communication

• Communication Through Removable Media • Multilayer Encryption
• Connection Proxy • Port Knocking
• Custom Command & Control Protocol • Remote Access Tools
• Custom Cryptographic Protocol • Remote File Copy
• Data Encoding • Standard Cryptographic Protocol
• Data Obfuscation • Standard Non-Application Layer Protocol
• Domain Fronting • Uncommonly Used Port
• Fallback Channels • Web Service
• Multi-hop Proxy

Source: MITRE, ATT&CK™ for Enterprise Cyber Startup Observatory© - Insight