###### Abstract  
The widespread adoption of cloud-based and public legitimate services (CPLS) has inadvertently opened up new avenues for cyber attackers to establish covert and resilient command-and-control (C&C) communication channels. This abuse poses a significant cybersecurity threat, as it allows malicious traffic to blend seamlessly with legitimate network activities. Traditional detection systems are proving inadequate in accurately identifying such abuses, emphasizing the urgent need for more advanced detection techniques. In our study, we conducted an extensive systematic literature review (SLR) encompassing the academic and industrial literature from 2008 to July 2023. Our review provides a comprehensive categorization of the attack techniques employed in CPLS abuses and offers a detailed overview of the currently developed detection strategies. Our findings indicate a substantial increase in cloud-based abuses, facilitated by various attack techniques. Despite this alarming trend, the focus on developing detection strategies remains limited, with only 7 out of 91 studies addressing this concern. Our research serves as a comprehensive review of CPLS abuse for the C&C infrastructure. By examining the emerging techniques used in these attacks, we aim to make a significant contribution to the development of effective botnet defense strategies. b +
Footnote †: journal: Cybersecurv. Pri. 0000-0002-0001-5000]C. C.  
addresses, DNS names, or node identifiers within peer-to-peer overlays embedded in the binary code. The motivation for undertaking this SLR is provided in Section 2.2. Botnet authors have evolved their tactics by abusing the CPLS, as shown in Table 1, which includes services such as Microsoft Outlook, OneDrive, Slack, Dropbox, Pastebin, Twitter, and Google Drive. They utilize these services to establish C&C communication channels. By setting up a serverless C&C infrastructure within these services, botmasters can establish communication with bots that have been planted on victims' systems, thus evading detection. These stealthy communication channels leverage the trust placed in enterprise-authorized services, the reputable names of CPLS vendors, and secure communication protocols like transport layer security (TLS). This combination provides adversaries with an additional layer of protection. Furthermore, users trust CPLS vendors implicitly to protect their data and provide secure access to it. However, malware authors exploit this trust, blending their malicious traffic within the legitimate traffic flow of these services. This subterfuge poses significant challenges for defenders, complicating their efforts to detect and prevent such attacks. These factors make cloud-based services an appealing choice for malware authors. Despite the range of defense mechanisms proposed in the literature, our analysis revealed a deficiency in detection systems for effectively identifying the abuse of the CPLS as C&C infrastructure. This research gap was identified through this SLR. Given the absence of a comprehensive overview on the latest attack techniques employed to abuse CPLS as a C&C infrastructure, we investigate these techniques and explore associated detection approaches. Although a related survey [3] addressed abuses against CPLS, it does not comprehensively cover all attack techniques, reporting on only four techniques: encoding, steganography, free accounts, and user generation algorithm (UGA). In contrast, our work encompasses nine techniques. Another study [4] focused on social bots and reported on a single abuse incident, where image steganography was used to employ Facebook and Twitter as C&C mediums. To our knowledge, this is the first systematic review that categorizes attack techniques used to abuse CPLS, along with their detection approaches. The main contributions are as follows:  
* Analyze existing studies relating to the abuse of CPLS as C&C servers. * Introduce a new taxonomy of attack techniques that abuse the CPLS as a C&C server. * Introduce a new taxonomy of C&C communication channels.