Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › WebSocket Command and Control

WebSocket Command and Control

2 min read

Jump to:

Overview

WebSocket Command and Control (C2) is a technique used by adversaries to establish and maintain communication channels with compromised systems through the WebSocket protocol. This approach facilitates real-time, bidirectional data exchange, enabling attackers to issue commands and receive responses stealthily during various stages of an intrusion. Its use supports evasion of traditional network defenses due to WebSocket’s legitimate and persistent connection characteristics.

Attack Objective

Maintain covert command and control communication with compromised hosts
Supports multiple attack lifecycle stages, primarily Command & Control, Execution, Persistence, and Lateral Movement
Advances attacker position by enabling continuous interaction with the target environment while minimizing detection risk

How the Technique Works

Adversaries leverage the WebSocket protocol to create persistent, full-duplex communication channels between a compromised endpoint and a remote server controlled by the attacker. Unlike traditional HTTP requests, WebSocket connections remain open, allowing real-time command delivery and data exfiltration. Attackers may embed malicious WebSocket clients within compromised applications or scripts, facilitating stealthy control without repeated connection handshakes.

Common Methods & Variations

Use of custom or modified WebSocket clients embedded in malware or scripts
Deployment in on-premises environments as well as cloud-hosted infrastructure
Variants include leveraging legitimate web applications or services to proxy WebSocket traffic
Living-off-the-land approaches utilizing native WebSocket support in browsers or frameworks versus custom tooling

Indicators of Compromise (IOCs)

Unusual or unauthorized persistent WebSocket connections in network logs
Unexpected WebSocket traffic to external or suspicious IP addresses or domains
Endpoint artifacts such as scripts or binaries initiating WebSocket connections
Authentication anomalies or irregular session patterns associated with WebSocket endpoints

Detection Strategies

Network telemetry capturing WebSocket handshake and data frames for anomaly analysis
Behavioral detection focusing on persistent, irregular WebSocket connections outside normal usage patterns
Correlation of endpoint process activity with network WebSocket sessions

Mitigation & Prevention

Implement network segmentation and strict egress filtering to limit unauthorized WebSocket traffic
Enforce application whitelisting and monitor for unauthorized WebSocket client usage
Apply robust authentication and encryption controls on WebSocket endpoints
User training to recognize phishing or social engineering vectors that may deliver WebSocket-based payloads

Response Considerations

Immediately isolate affected systems to disrupt WebSocket C2 channels
Conduct comprehensive network and endpoint analysis to identify scope and persistence mechanisms
Remove malicious WebSocket clients and harden systems against re-infection
Review and update detection rules to identify similar future activity

Related Techniques

Use of other C2 protocols such as HTTP/S, DNS, or custom encrypted channels
Execution techniques involving script interpreters or web browsers
Persistence methods embedding WebSocket clients into legitimate applications
Lateral movement leveraging established WebSocket connections

Mapping & References

MITRE ATT&CK: Command and Control (TA0011), Web Service (T1102)
Public research on WebSocket-based malware and C2 frameworks
Security advisories highlighting detection and mitigation of WebSocket C2 activity

Tags: ATT&CK Command and Control cyber threats Detection Execution lateral movement Mitigation network security persistence WebSocket