Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › HTTP-Based Command and Control

HTTP-Based Command and Control

2 min read

Jump to:

Overview

HTTP-Based Command and Control (C2) is a technique where adversaries use the Hypertext Transfer Protocol (HTTP) to communicate with compromised systems during an intrusion. This method enables attackers to issue commands, receive data, and maintain control over victims while blending in with normal web traffic. It is commonly employed during the Command & Control phase of the attack lifecycle due to its ability to evade detection and bypass network security controls.

Attack Objective

Establish and maintain covert communication channels for remote control and data exchange
Supports the Command & Control stage, often following initial access and execution
Advances attacker persistence, enables lateral movement, and facilitates data exfiltration or further exploitation

How the Technique Works

Adversaries leverage HTTP requests and responses to transmit commands and receive output from compromised hosts. By using standard web protocols and ports (typically TCP port 80 or 443), the communication blends with legitimate traffic, making it difficult to distinguish malicious activity. Payloads may be encoded or encrypted within HTTP headers, URLs, or message bodies to avoid detection. The technique often involves periodic polling or beaconing to a remote server controlled by the attacker.

Common Methods & Variations

Use of HTTP GET or POST requests to send commands and receive data
Communication over HTTP or HTTPS to evade network filtering and inspection
Deployment on endpoints, cloud workloads, or network devices
Utilization of living-off-the-land binaries (e.g., curl, wget, PowerShell) versus custom or open-source C2 frameworks

Indicators of Compromise (IOCs)

Unusual or periodic HTTP traffic patterns to uncommon domains or IP addresses
HTTP requests containing anomalous headers, parameters, or encoded payloads
Unexpected outbound connections on standard web ports from non-browser processes
Endpoint process creation logs showing use of scripting or command-line tools for network communication

Detection Strategies

Network traffic analysis focusing on HTTP session anomalies and uncommon destinations
Behavioral detection of periodic beaconing or data exfiltration patterns over HTTP
Correlation of endpoint process activity with network connections to identify suspicious command execution

Mitigation & Prevention

Implement network segmentation and restrict outbound HTTP/HTTPS traffic to trusted destinations
Deploy web proxy and deep packet inspection to analyze and filter suspicious HTTP traffic
Enforce least privilege on endpoints to limit use of scripting and network utilities
Use multi-factor authentication and strong credential management to reduce compromise risk

Response Considerations

Isolate affected systems to prevent further C2 communication and lateral movement
Collect and analyze network logs and endpoint artifacts to identify scope and timeline
Remove persistence mechanisms and harden network controls to prevent re-establishment

Related Techniques

Beaconing for periodic communication
Data Staged or Exfiltration over Web Service
Use of Living-off-the-Land Binaries for execution and communication

Mapping & References

MITRE ATT&CK T1071.001 – Application Layer Protocol: Web Protocols
Public research on HTTP-based C2 frameworks and detection methodologies
Security advisories detailing incidents involving HTTP C2 channels

Tags: Attack Lifecycle Command & Control Cyber Defense endpoint security MITRE ATT&CK network security Network Traffic Analysis Threat Detection