Home TacticsC2

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0011

Command and Control

The adversary is trying to communicate with compromised systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control.

Associated Techniques(15)

T1071

Application Layer Protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering.

4 sub-techniques

T1132

Data Encoding

Adversaries may encode data to make the content of command and control traffic more difficult to detect.

2 sub-techniques

T1001

Data Obfuscation

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

3 sub-techniques

T1568

Dynamic Resolution

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

3 sub-techniques

T1573

Encrypted Channel

Adversaries may employ a known encryption algorithm to conceal command and control traffic.

2 sub-techniques

T1008

Fallback Channels

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible.

T1105

Ingress Tool Transfer

Adversaries may transfer tools or other files from an external system into a compromised environment.

T1104

Multi-Stage Channels

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.

T1095

Non-Application Layer Protocol

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts.

T1571

Non-Standard Port

Adversaries may communicate using a protocol and port pairing that are typically not associated.

T1572

Protocol Tunneling

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering.

T1090

Proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.

4 sub-techniques

T1219

Remote Access Software

An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel.

T1205

Traffic Signaling

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

2 sub-techniques

T1102

Web Service

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

3 sub-techniques

CIC-ATT&CK

ATT&CK Tactics

Recon

Resource Dev

Initial Access

Execution

Persistence

Priv Esc

Defense Evasion

Cred Access

Discovery

Lateral Move

Collection

C2

Exfiltration

Impact

Command and Control

Associated Techniques(15)

Application Layer Protocol

Data Encoding

Data Obfuscation

Dynamic Resolution

Encrypted Channel

Fallback Channels

Ingress Tool Transfer

Multi-Stage Channels

Non-Application Layer Protocol

Non-Standard Port

Protocol Tunneling

Proxy

Remote Access Software

Traffic Signaling

Web Service