Application Layer Protocol for C2 and Exfil to Cloud

Command and Control (“C2”) is the general group of techniques used to establish and conduct remote communication with assets, applications and environments under unauthorized control.

This course will focus on the use of techniques that use C2. The Application Layer Protocol: Web Protocol sub-technique uses web-related network protocols such as HTTP for communication channels for C2. Web protocols are among those most likely to be broadly allowed for outbound communication through a firewall, even for more strictly controlled environments.

Exfiltration is an exceptionally common tactic and involves the unauthorized extraction or theft of data from a target system, network or application. Even during an attack where data theft is not the primary objective, the adversary may need to extract data necessary to execute other techniques. For example, an adversary may need to collect password hashes to attempt an offline crack. This method of data collection or extraction is often referred to as “exfiltration”.

Learn how to detect and mitigate these techniques to protect your organization from this highly sophisticated type of attack.

Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT29. Prevent adversaries from accomplishing the tactics of Command and Control and Exfiltration.