Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › Cloud Service-Based Command and Control

Cloud Service-Based Command and Control

2 min read

Jump to:

Overview

Cloud Service-Based Command and Control (C2) is a technique where adversaries leverage legitimate cloud services to establish and maintain communication channels with compromised systems. This method supports various stages of the attack lifecycle by enabling remote control, data exfiltration, and operational stealth. Attackers favor cloud services due to their widespread trust, availability, and difficulty to block without impacting legitimate business functions.

Attack Objective

Maintain covert command and control over compromised assets
Supports Command & Control, Persistence, and Lateral Movement stages
Allows attackers to issue commands, receive data, and adapt operations while evading traditional network defenses

How the Technique Works

Adversaries use cloud-based platforms—such as file storage, messaging, or collaboration services—to relay commands and exfiltrate data. Compromised hosts communicate with these services using standard protocols and legitimate APIs, blending malicious traffic with normal cloud usage. This approach leverages the cloud provider’s infrastructure to bypass network filtering and detection mechanisms.

Common Methods & Variations

Utilizing popular cloud storage services (e.g., file uploads/downloads) for command exchange
Employing cloud-based email, chat, or collaboration tools as communication channels
Variants include use of identity tokens or cloud-native functions to execute commands
Living-off-the-land tactics by abusing legitimate cloud APIs versus deploying custom C2 infrastructure

Indicators of Compromise (IOCs)

Unusual or unauthorized cloud service API calls from endpoints
Unexpected authentication events or token usage in cloud environments
Network traffic patterns showing frequent, small data transfers to cloud services outside normal baselines
Presence of suspicious scripts or binaries interacting with cloud service endpoints

Detection Strategies

Monitoring cloud service logs for anomalous access patterns and API usage
Behavioral analytics to identify deviations in endpoint-to-cloud communications
Correlation of identity and access logs with endpoint telemetry to detect unauthorized cloud interactions

Mitigation & Prevention

Implement strict cloud service access controls and least privilege principles
Enforce multi-factor authentication and conditional access policies for cloud identities
Network segmentation and egress filtering to limit unauthorized cloud communications
Continuous monitoring and alerting on abnormal cloud service usage patterns

Response Considerations

Isolate affected endpoints and revoke compromised cloud credentials immediately
Conduct comprehensive log analysis across cloud and endpoint environments to scope the intrusion
Reset or rotate cloud service tokens and review access policies
Harden cloud configurations and update detection rules to prevent recurrence

Related Techniques

Use of Web Services for C2
Application Layer Protocol: HTTP/S C2
Credential Access and Token Manipulation in cloud environments
Data Staged and Exfiltration over Cloud Services

Mapping & References

MITRE ATT&CK: T1071.004 – Application Layer Protocol: Cloud Services
MITRE ATT&CK: T1567 – Exfiltration Over Web Service
Public advisories on abuse of cloud platforms for C2 from security vendors and CERTs
Research papers analyzing cloud-based adversary infrastructure and detection methodologies

Tags: Adversary Techniques Attack Lifecycle Cloud Security Cloud Services Command and Control cyber threats Detection Incident Response Mitigation TTPs