sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
During Operation Wocao, threat actors’ XServer tool communicated using HTTP and HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During the SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT18 uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT33 has used HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT37 uses HTTPS to conceal C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT39 has used HTTP in communications with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BITTER has used HTTP POST requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BRONZE BUTLER malware has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Chimera has used HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Cobalt Group has used HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Confucius has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FIN13 has used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FIN4 has used HTTP POST requests to transmit data.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FIN8 has used HTTPS for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Gamaredon Group has used HTTP and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
HAFNIUM has used open-source C2 frameworks, including Covenant.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Higaisa used HTTP and HTTPS to send data back to its C2 server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Inception has used HTTP, HTTPS, and WebDav in network communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Kimsuky  has used HTTP GET and POST requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Lazarus Group has conducted C2 over HTTP and HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
LuminousMoth has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Magic Hound has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Metador has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
MuddyWater has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Mustang Panda has communicated with its C2 via HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
OilRig has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Orangeworm has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Rancor has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Sidewinder has used HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SilverTerrier uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Stealth Falcon malware communicates with its C2 server via HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
TA505 has used HTTP to communicate with C2 nodes.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
TA551 has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Threat Group-3390 malware has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Tropic Trooper has used HTTP in communication with the C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Turla has used HTTP and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
WIRTE has used HTTP for network communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Windshift has used tools that communicate with C2 over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Wizard Spider has used HTTP for network communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
3PARA RAT uses HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
4H RAT uses HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ABK has the ability to use HTTP in communications with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ANDROMEDA has the ability to make GET requests to download files from C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Action RAT can use HTTP to communicate with C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Agent Tesla has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Amadey has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Anchor has used HTTP and HTTPS in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
AppleJeus has sent data to its C2 server via `POST` requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
AppleSeed has the ability to communicate with C2 over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Aria-body has used HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
AuTo Stealer can use HTTP to communicate with its C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Avenger has the ability to use HTTP in communication with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BACKSPACE uses HTTP as a transport to communicate with its command server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BADNEWS establishes a backdoor over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BBK has the ability to use HTTP in communications with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BLINDINGCAN has used HTTPS over port 443 for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BUBBLEWRAP can communicate using HTTP or HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BackConfig has the ability to use HTTPS for C2 communiations.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BadPatch uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Bankshot uses HTTP for command and control communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Bisonal has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BlackEnergy communicates with its C2 server over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BlackMould can send commands to C2 in the body of HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
BoomBox has used HTTP POST requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Brute Ratel C4 can use HTTPS and HTTPS for C2 communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Bundlore uses HTTP requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Various implementations of CHOPSTICK communicate with C2 over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
CORESHELL can communicate over HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
CSPY Downloader can use GET requests to download additional payloads from C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
The Carbanak malware communicates to its command server using HTTP with an encrypted payload.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Carberp has connected to C2 servers via HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Carbon can use HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Cardinal RAT is downloaded using HTTP over port 443.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Chaes has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
CharmPower can use HTTP to communicate with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
China Chopper's server component executes code sent via HTTP POST commands.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Clambling has the ability to communicate over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
One variant of CloudDuke uses HTTP and HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ComRAT has used HTTP requests for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Comnie uses HTTP for C2 communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
CreepySnail can use HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Crimson can use a HTTP GET request to download its final payload.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Crutch has conducted C2 communications with a Dropbox account using the HTTP API.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Cyclops Blink can download files via HTTP and HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DEATHRANSOM can use HTTPS to download files.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DRATzarus can use HTTP or HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Dacls can use HTTPS in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DanBot can use HTTP in C2 communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DarkComet can use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DarkTortilla has used HTTP and HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DarkWatchman uses HTTPS for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Daserf uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DealersChoice uses HTTP for communication with the C2 server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Diavol has used HTTP GET and POST requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Dipsind uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Doki has communicated with C2 over HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Donut can use HTTP to download previously staged shellcode payloads.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DownPaper communicates to its C2 server over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Dridex has used POST requests and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
DustySky has used both HTTP and HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Dyre uses HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ELMER uses HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Egregor has communicated with its C2 servers via HTTPS protocol.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Elise communicates over HTTP or HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Emissary uses HTTP or HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Emotet has used HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Empire can conduct command and control over protocols like HTTP and HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Epic uses HTTP and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
EvilBunny has executed C2 commands directly via HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Exaramel for Linux uses HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Explosive has used HTTP for communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FRAMESTING can retrieve C2 commands from values stored in the `DSID` cookie from the current HTTP request or from decompressed zlib data within the request's `POST` data.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FatDuke can be controlled via a custom C2 protocol over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Felismus uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Final1stspy uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Flagpro can communicate with its C2 using HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FlawedAmmyy has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Gazer communicates with its C2 servers over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Gelsemium can use HTTP/S in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GeminiDuke uses HTTP and HTTPS for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Get2 has the ability to use HTTP to send information collected from an infected host to C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Gold Dragon uses HTTP for communication to the control servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GoldFinder has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Goopy has the ability to communicate with its C2 over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Grandoreiro has the ability to use HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GravityRAT uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GreyEnergy uses HTTP and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GrimAgent has the ability to use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
GuLoader can use HTTP to retrieve additional binaries.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
HTTPBrowser has used HTTP and HTTPS for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Helminth can use HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Hi-Zor communicates with its C2 server over HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Hikit has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
HyperBro has used HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
IceApple can use HTTP GET to request and pull information from C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
IcedID has used HTTPS in communications with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Industroyer’s main backdoor connected to a remote C2 server using HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
InvisiMole uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Ixeshe uses HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
KEYPLUG has the ability to communicate over HTTP and WebSocket Protocol (WSS) for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
KGH_SPY can send data to C2 with HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
KONNI has used HTTP POST for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
KOPILUWAK has used HTTP POST requests to send data to C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Variants of Kevin can communicate with C2 over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Keydnap uses HTTPS for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Kinsing has communicated with C2 over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Koadic has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
The Komplex C2 channel uses HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
LIGHTWIRE can use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
LOWBALL command and control occurs via HTTPS over port 443.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
LiteDuke can use HTTP GET requests in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
LitePower can use HTTP and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Lokibot has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
LookBack’s C2 proxy tool sends data to a C2 server over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
MCMD can use HTTPS in communication with C2 web servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
MacSpy uses HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Machete uses HTTP for Command & Control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Mafalda can use HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Maze has communicated to hard-coded IP addresses via HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
MechaFlounder has the ability to use HTTP in communication with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Metamorfo has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Micropsia uses HTTP and HTTPS for C2 network communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Milan can use HTTPS for communication with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
MiniDuke uses HTTP and HTTPS for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Mis-Type network traffic can communicate over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Mongall can use HTTP for C2 communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
More_eggs uses HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Mythic supports HTTP-based C2 profiles.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
NETWIRE has the ability to communicate over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
NGLite will initially beacon out to the NKN network via an HTTP POST over TCP 30003.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
NOKKI has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Neoichor can use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Ninja can use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
OLDBAIT can use HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
OSX_OCEANLOTUS.D can also use use HTTP POST and GET requests to send and receive C2 information.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Octopus has used HTTP GET and POST requests for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Okrum uses HTTP for communication with its C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
OnionDuke uses HTTP and HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
OopsIE uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Out1 can use HTTP and HTTPS in communications with remote hosts.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
OutSteel has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
P.A.S. Webshell can issue commands via HTTP POST.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PLEAD has used HTTP for communications with command and control (C2) servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
POWERTON has used HTTP/HTTPS for C2 traffic.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
POWRUNER can use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PULSECHECK can check HTTP request headers for a specific backdoor key and if found will output the result of the command in the variable `HTTP_X_CMD.`
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Pandora can communicate over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PcShare has used HTTP for C2 communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Peppy can use HTTP to communicate with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
A PingPull variant can communicate with its C2 servers by using HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PlugX can be configured to use HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PoetRAT has used HTTP and HTTPs for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PolyglotDuke has has used HTTP GET requests in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Pony has sent collected information to the C2 via HTTP POST request.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PowGoop can send HTTP GET requests to malicious servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Proxysvc uses HTTP over SSL to communicate commands with the control server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Psylo uses HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Pteranodon can use HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Pupy can communicate over HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
QUADAGENT uses HTTPS and HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
QUIETCANARY can use HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
QuietSieve can use HTTPS in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
RATANKBA uses HTTP/HTTPS for command and control communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
RCSession can use HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
REvil has used HTTP and HTTPS in communication with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
RGDoor uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ROKRAT can use HTTP and HTTPS for command and control communication.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
RTM has initiated connections to external domains using HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
RainyDay can use HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Ramsay has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Some Reaver variants use HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
The Regin malware platform supports many standard protocols, including HTTP and HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Remexi uses BITSAdmin to communicate with the C2 server over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Remsec is capable of using HTTP and HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Rising Sun has used HTTP and HTTPS for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
S-Type uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SLIGHTPULSE has the ability to process HTTP GET requests as a normal web server and to insert logic that will read or write files or execute commands in response to HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SNUGRIDE communicates with its C2 server over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
STEADYPULSE can parse web requests made to a targeted server to determine the next stage of execution.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
A SUGARDUMP variant has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SVCReady can communicate with its C2 servers via HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Saint Bot has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Sakula uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Samurai can use a .NET HTTPListener class to receive and handle HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SeaDuke uses HTTP and HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Seasalt uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ServHelper uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Shamoon has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Shark has the ability to use HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ShimRat communicated over HTTP and HTTPS with C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ShimRatReporter communicated over HTTP with preconfigured C2 servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Sibot communicated with its C2 server via HTTP GET requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SideTwist has used HTTP GET and POST requests over port 443 for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Sliver has the ability to support C2 communications over HTTP/S.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Smoke Loader uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SoreFang can use HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Spark has used HTTP POST requests to communicate with its C2 server to receive commands.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Squirrelwaffle has used HTTP POST requests for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
StrongPity can use HTTP and HTTPS in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Stuxnet uses HTTP to communicate with a command and control server.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Sys10 uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Taidoor has used HTTP GET and POST requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ThiefQuest uploads files via unencrypted HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
TinyTurla can use HTTPS in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Tomiris can use HTTP to establish C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Torisma can use HTTP and HTTPS for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
TrailBlazer has used HTTP requests for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Trojan.Karagany can communicate with C2 via HTTP POST requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Turian has the ability to use HTTP for its C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
UBoatRAT has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control