Procedure examples

XORIndex Loader has used HTTPS POST to communicate with C2.

Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.

Covenant can establish command and control via HTTP.

ShimRatReporter communicated over HTTP with preconfigured C2 servers.

Sliver has the ability to support C2 communications over HTTP and HTTPS.

evilginx2 can proxy HTTPS connections between victims and destination websites.

Empire can conduct command and control over protocols like HTTP and HTTPS.

FRP has the ability to use HTTP and HTTPS to enable the forwarding of requests for internal services via domain name.

PcShare has used HTTP for C2 communication.

PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.

CSPY Downloader can use GET requests to download additional payloads from C2.

Brute Ratel C4 can use HTTPS and HTTPS for C2 communication.

Out1 can use HTTP and HTTPS in communications with remote hosts.

MCMD can use HTTPS in communication with C2 web servers.

Donut can use HTTP to download previously staged shellcode payloads.

Koadic has used HTTP for C2 communications.

Pupy can communicate over HTTP for C2.

Mythic supports HTTP-based C2 profiles.

Quick Assist communicates over TCP 443 via HTTPS to a remote session server, under which RDP traffic is transferred.

TeamPCP Cloud Stealer has used `curl` to upload stolen data to attacker controlled domains.

Mini Shai-Hulud has has exfiltrated data through the use of HTTPS POST requests to C2 domains.

Kali365's desktop client has made Microsoft Graph API calls using the distinct User-Agent string `kali365-live/1.0.0` to access victim mailboxes and enumerate account data following OAuth token capture.

NOKKI has used FTP for C2 communications.

Havoc can use an SMB listener for C2 communication.

SharpDisco has the ability to transfer data between SMB shares.

BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.

Machete uses FTP for Command & Control.

PUBLOAD has used `curl` for data exfiltration over FTP.

The Regin malware platform supports many standard protocols, including SMB.

Kazuar uses FTP and FTPS to communicate with the C2 server.

XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.

Attor has used FTP protocol for C2 communication.

Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

PoetRAT has used FTP for C2 communications.

ZxShell has used FTP for C2 connections.

JPIN can communicate over FTP.

Disco can use SMB to transfer files.

Qilin can use WinSCP for the secure file transfer of the Linux ransomware binary to a targeted system.

ShadowPad has used FTP for C2 communications.

SYSCON has the ability to use FTP in C2 communications.

CARROTBALL has the ability to use FTP in C2 communications.

Mythic supports SMB-based peer-to-peer C2 profiles.

PowerExchange can receive and send back the results of executed C2 commands through email.

OLDBAIT can use SMTP for C2.

IMAPLoader uses the IMAP email protocol for command and control purposes.

RDAT can use email attachments for C2 communications.

NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.

CORESHELL can communicate over SMTP and POP3 for C2.

Remsec is capable of using SMTP for C2.

LightNeuron uses SMTP for C2.