Phoning home
Model how both incidents kept a channel to the attacker, and how one was caught.
Course › Lesson 6 of 7
Command and Control
Command and control (C2) is the attacker's channel back to the systems they've compromised, kept quiet so it isn't noticed. In the Westfield case study, it's how captured credentials reached LedgerWraith in near-real-time, and how QUIETPIVOT's scheduled task kept phoning home, until the university's monitoring caught it.
The case study. This lesson uses the University of Westfield master case study from Cyber Security Fundamentals. If you've followed the earlier lessons you'll recognise the attack; each lesson looks at one stage of it.
What command and control is
C2 is the communication channel between the attacker and the systems inside the target. It maps to ATT&CK's Command and Control tactic. The attacker's aim is a channel that's reliable but looks ordinary, so it hides among normal traffic leaving the organisation.
In the Westfield attack
In Incident 1, the fake page relayed each captured credential straight to a command-and-control panel and passed the victim on to the real site. In Incident 2, the scheduled task periodically re-established contact with external infrastructure. Both disguised their traffic as ordinary web requests. In Incident 2, the repeated failed attempts to reach the research data store were logged by Westfield's Splunk SIEM and flagged, which is how the intrusion was caught.
This stage in ATT&CK
| Code | Technique | In this case study |
|---|---|---|
T1071.001 | Application Layer Protocol: Web Protocols | C2 disguised as normal web traffic |
T1001 | Data Obfuscation | Making the traffic blend in |
T1105 | Ingress Tool Transfer | (Related) pulling in more tools over C2 |
T1071.004 | Application Layer Protocol: DNS | (Task B) tunnelling C2 over DNS |
T1102 | Web Service | (Task B) hiding messages on a legitimate service |
Hover over any code in the builder to see ATT&CK's own description.
Defending against this stage
C2 is defended at the network edge. For T1071.001, ATT&CK lists M1031 Network Intrusion Prevention and M1037 Filter Network Traffic. Prevention alone is never complete, because a determined attacker can make traffic look very ordinary, so detection matters just as much: a channel that's spotted can be cut. Westfield's SIEM is exactly this detection layer, and it's what turned Incident 2 from a breach into a contained event.
Worked example
Your tasks
Each task opens in the builder with the scenario beside your graph. Build your graph, press Check my graph for feedback as often as you like, then compare with the model answer. Your work on each task is saved in your browser.
Staying in touch
Map the different C2 channels an attacker could use, and how each might be detected.
When you've finished, you can send your graph and its activity log to your tutor with Email to tutor in the builder.