Application Layer Protocol for C2 and Exfil to Cloud

Threat actors like APT29 use Application Layer Protocols for Command and Control (C2) so they can blend in and avoid detection. They also may attempt to steal data and exfiltrate it to a cloud storage service as the end-goal of their attack. In this course, you will learn about these techniques and get practice detecting them in our virtual lab.

Course Content

Detection, Validation, and Mitigation (Lab)


Application Layer Protocol for C2 and Exfil over C2
What is the “Exfiltration to Cloud Storage” Technique?


Application Layer Protocol for C2 and Exfil over C2
What is the “Application Layer Protocol: Web Protocols” Technique?


Application Layer Protocol for C2 and Exfil over C2
Course Description

Command and Control (“C2”) is the general group of techniques used to establish and conduct remote communication with assets, applications and environments under unauthorized control.

This course will focus on the use of techniques that use C2. The Application Layer Protocol: Web Protocol sub-technique uses web-related network protocols such as HTTP for communication channels for C2. Web protocols are among those most likely to be broadly allowed for outbound communication through a firewall, even for more strictly controlled environments.

Exfiltration is an exceptionally common tactic and involves the unauthorized extraction or theft of data from a target system, network or application. Even during an attack where data theft is not the primary objective, the adversary may need to extract data necessary to execute other techniques. For example, an adversary may need to collect password hashes to attempt an offline crack. This method of data collection or extraction is often referred to as “exfiltration”.

Learn how to detect and mitigate these techniques to protect your organization from this highly sophisticated type of attack.

Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT29. Prevent adversaries from accomplishing the tactics of Command and Control and Exfiltration.

This course is part of a Career Path:
No items found.

Instructed by

Master Instructor
Matthew Mullins

Matt has led multiple Red Team engagements, ranging from a few weeks to a year and covering multiple security domains. Outside of Red Teaming, Matt is also a seasoned penetration tester with interests in: AppSec, OSINT, Hardware, Wifi, Social Engineering, and Physical Security. Matt has a Master's degree in Information Assurance and an exhaustive number of certifications ranging from frameworks, management, and hands-on hacking. Matt is a Technical SME at Cybrary, focusing on Adversarial Emulation and Red Teaming for course content.

Chris Daywalt

After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume, much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.

Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:

  • 30% doing DFIR
  • 30% teaching DFIR
  • 20% monitoring and detection engineering
  • 15% risk assessment
  • 5% other stuff, like sneaking in a game of Plants vs. Zombies or taking a quick nap at the desk (Don’t judge - I work overtime)

    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a Application Layer Protocol for C2 and Exfil to Cloud Certificate of Completion