Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › HTTPS-Based Command and Control

HTTPS-Based Command and Control

2 min read

Jump to:

Overview

HTTPS-Based Command and Control (C2) is a technique where adversaries use the HTTPS protocol to communicate with compromised systems, enabling remote control and data exchange. This approach leverages the widespread use and trusted nature of HTTPS to blend malicious traffic with legitimate encrypted web traffic, complicating detection and analysis. It is commonly employed during the Command & Control phase of the attack lifecycle to maintain stealthy and persistent communication channels.

Attack Objective

Establish and maintain covert control over compromised hosts
Supports the Command & Control stage, often following initial access and execution
Enables attackers to issue commands, exfiltrate data, and update malware while evading network defenses

How the Technique Works

Adversaries configure malware or implants on compromised endpoints to communicate with external servers over HTTPS, encapsulating C2 traffic within standard web protocols. This encrypted communication typically involves periodic polling or beaconing to retrieve commands and send responses, leveraging legitimate ports (e.g., TCP 443) and protocols to evade firewall and intrusion detection systems. The use of TLS encryption prevents straightforward inspection of payloads, allowing attackers to maintain persistent and stealthy control.

Common Methods & Variations

Use of custom or open-source C2 frameworks that mimic legitimate HTTPS traffic patterns
Deployment in on-premises environments or cloud infrastructure to host C2 servers
Living-off-the-land tactics utilizing native system utilities or scripting languages to initiate HTTPS connections
Variations include domain fronting, use of legitimate cloud services, or compromised web servers as proxies

Indicators of Compromise (IOCs)

Unusual or periodic HTTPS connections to rare or suspicious domains
Encrypted traffic patterns inconsistent with normal user behavior
Endpoint artifacts such as suspicious processes initiating HTTPS requests or anomalous TLS certificate usage
Network logs showing beaconing intervals or data exfiltration over HTTPS

Detection Strategies

Monitoring network telemetry for anomalous HTTPS traffic patterns and uncommon destination domains
Behavioral analysis focusing on process activity related to HTTPS connections and timing anomalies
Correlation of endpoint and network data to identify suspicious encrypted communications
Use of TLS inspection where feasible, combined with metadata analysis to detect irregularities

Mitigation & Prevention

Implement strict egress filtering and domain allowlisting to limit outbound HTTPS connections
Deploy network segmentation and monitoring to reduce exposure and detect lateral movement
Enforce least privilege and application control to prevent unauthorized execution of code initiating HTTPS connections
Use multi-factor authentication and strong credential management to reduce compromise risk

Response Considerations

Immediately isolate affected systems to disrupt C2 communication
Conduct comprehensive network and endpoint forensic analysis to identify scope and persistence mechanisms
Revoke or rotate credentials potentially exposed during the incident
Apply patches and harden configurations to prevent reinfection and future exploitation

Related Techniques

Beaconing for periodic communication with C2 servers
Use of encrypted channels for data exfiltration
Living-off-the-land binaries and scripts to evade detection
Domain fronting and proxying to obscure C2 server locations

Mapping & References

MITRE ATT&CK: T1071.001 – Application Layer Protocol: Web Protocols
Public research on HTTPS C2 evasion techniques and detection methodologies
Industry advisories on encrypted C2 traffic and network defense best practices

Tags: ATT&CK Command and Control cyber threats Detection Encrypted Communication HTTPS Incident Response malware Mitigation network security