Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › Email-Based Command and Control

Email-Based Command and Control

3 min read

Jump to:

Overview

Email-Based Command and Control (C2) is a technique where adversaries use email communication channels to send commands to and receive data from compromised systems. This method supports maintaining control over victim environments covertly, leveraging ubiquitous email infrastructure to evade network-based detection. It is employed across multiple stages of the attack lifecycle to facilitate stealthy command execution and data exfiltration.

Attack Objective

Establish and maintain covert control over compromised systems
Supports Command & Control, Persistence, and Execution stages of the attack lifecycle
Enables attackers to issue commands, receive responses, and exfiltrate data while blending with legitimate email traffic

How the Technique Works

Adversaries configure compromised hosts or malware implants to communicate with attacker-controlled email accounts. Commands are embedded within email messages, often using obfuscation or encryption, and sent to the victim system’s email client or a custom email parser. The compromised system processes these commands and sends results or stolen data back via outbound emails. This method exploits the widespread use and trusted nature of email protocols to bypass network security controls.

Common Methods & Variations

Use of standard email protocols such as SMTP, IMAP, and POP3 for command delivery and data exfiltration
Embedding commands in email body, attachments, or headers using encoding or encryption
Deployment on on-premises endpoints or cloud-hosted email services
Leveraging legitimate email clients or custom lightweight mail parsers within malware
Living-off-the-land approaches using native email clients and scripting versus custom-built C2 frameworks

Indicators of Compromise (IOCs)

Unusual outbound email traffic patterns, including unexpected recipients or volumes
Emails containing suspicious attachments or encoded payloads
Presence of unknown email accounts configured on endpoints or mail servers
Logs showing anomalous use of email protocols outside normal business hours or patterns
Endpoint artifacts such as scripts or binaries interacting with email clients or services

Detection Strategies

Monitoring email gateway and mail server logs for anomalous send/receive patterns and unusual attachments
Behavioral analysis of endpoint processes interacting with email clients or network ports associated with email protocols
Correlation of email metadata with endpoint telemetry to identify suspicious command-response cycles
Signature-based detection for known malicious email payloads or encoded commands

Mitigation & Prevention

Implement strict email filtering and attachment scanning policies
Enforce least privilege for email client and scripting access on endpoints
Disable or restrict use of unnecessary email protocols and ports on critical systems
Deploy multi-factor authentication and strong password policies for email accounts
Use network segmentation to limit email client access on sensitive systems

Response Considerations

Immediately isolate affected systems to prevent further command and control communication
Analyze email logs and endpoint artifacts to identify scope and timeline of compromise
Reset credentials for email accounts involved and review access logs for unauthorized activity
Remove malicious scripts or binaries and apply security patches to affected systems
Enhance monitoring and update detection rules to prevent recurrence

Related Techniques

Phishing for Initial Access to deliver malware capable of email-based C2
Use of Web Service C2 channels as alternative covert communication methods
Data Staged and Exfiltration techniques leveraging email for data theft
Persistence mechanisms that maintain email client or service access

Mapping & References

MITRE ATT&CK: Command and Control (TA0011), specifically techniques involving Email Protocols (T1071.003)
Public research on email-based malware C2 frameworks and detection methodologies
Security advisories highlighting incidents involving email as a covert C2 channel

Tags: Command and Control Cyberattack Techniques email security endpoint security Exfiltration network security persistence Threat Detection