Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › API-Based Command and Control

API-Based Command and Control

2 min read

Jump to:

Overview

API-Based Command and Control (C2) is a technique where adversaries leverage legitimate application programming interfaces (APIs) to communicate with compromised systems and manage malicious operations. This approach is used during the Command & Control phase of the attack lifecycle to maintain stealth and persistence while evading traditional network detection mechanisms.

Attack Objective

Establish and maintain covert communication channels for remote control
Supports the Command & Control stage, and can facilitate Persistence, Lateral Movement, and Exfiltration
Enables attackers to issue commands, receive data, and adapt operations without triggering conventional security alerts

How the Technique Works

Adversaries exploit APIs provided by cloud services, social media platforms, or enterprise applications to send and receive commands. By embedding C2 traffic within legitimate API calls, attackers blend malicious activity with normal network behavior, making detection difficult. The technique often involves using API endpoints to upload commands, download stolen data, or orchestrate actions across multiple compromised hosts.

Common Methods & Variations

Utilization of public cloud APIs (e.g., AWS, Azure, Google Cloud) for command transmission
Abuse of social media or messaging platform APIs to relay commands and exfiltrate data
On-premises application APIs leveraged for lateral movement or persistence
Use of living-off-the-land techniques by employing legitimate API clients or scripting frameworks versus custom-built C2 tools

Indicators of Compromise (IOCs)

Unusual API call patterns or volumes inconsistent with normal user behavior
Authentication anomalies such as unexpected API keys or tokens usage
Network traffic to uncommon or suspicious API endpoints
Endpoint logs showing execution of API client tools or scripts not typical for the environment

Detection Strategies

Monitoring API usage logs and cloud service telemetry for anomalous access patterns
Behavioral analytics to identify deviations from baseline API call frequencies and destinations
Correlation of identity and access management events with network activity to detect unauthorized API interactions

Mitigation & Prevention

Implement strict API access controls and least privilege principles for service accounts and users
Enforce multi-factor authentication and rotate API keys regularly
Apply network segmentation and egress filtering to limit unauthorized API communications
Use anomaly detection tools to monitor API usage and alert on suspicious behavior

Response Considerations

Immediately revoke compromised API credentials and tokens
Conduct thorough investigation of API logs to identify scope and timeline of malicious activity
Review and harden API permissions and access policies post-incident
Implement enhanced monitoring to detect potential re-use or new API-based C2 attempts

Related Techniques

Use of Web Service APIs for Lateral Movement
Data Staged via Cloud Storage APIs
Living off the Land Binaries and Scripts (LOLBAS)
Credential Access through API Key Theft or Abuse

Mapping & References

MITRE ATT&CK: T1102 – Web Service, T1071.001 – Application Layer Protocol: Web Protocols
Public research on API abuse in cloud environments and social media platforms
Industry advisories on securing API endpoints and detecting anomalous API usage

Tags: API Abuse Cloud Security Command and Control Cyberattack Techniques Exfiltration Incident Response lateral movement persistence Security Monitoring Threat Detection