Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1102.002

T1102.002Bidirectional Communication

T1102.002 — Bidirectional Communication is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 22 detection use cases covering it and 15 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
22Use cases
15Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1102 · Web Service

Use cases covering this technique (22)

[WEEKLY] Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains Internal install · alerting DSPDDCSCW [WEEKLY] Script Interpreter or Package-Install Hook Egress to Free-Tier Edge SaaS Within 5 Minutes of Process Start Internal c2 · alerting DSΣPDD Potential Telegram API Request Via CommandLine ESCU actions · hunting P Windows DNS Query Request by Telegram Bot API ESCU actions · hunting P [LLM] Improvised C2 over public request-capture / pastebin / file-drop services from server infra Bespoke c2 · hunting DSΣCS [LLM] HOLLOWGRAPH M365 calendar dead-drop: events dated 2050-05-13 via Graph API Bespoke c2 · hunting DSP [LLM] Telegram Bot API used for C2 by non-browser/non-messaging process Bespoke c2 · hunting DSΣPDDCS [LLM] Anomalous DLL-host process reaching Microsoft Graph/login.microsoftonline for calendar C2 Bespoke c2 · hunting DSΣPDDCS [LLM] Telegram bot C2 / crypto-wallet exfiltration from script-host process Bespoke actions · hunting DSΣPDDCS [LLM] macOS.Gaslight Telegram Bot API C2 polling from non-browser process Bespoke c2 · hunting DSΣPCS [LLM] EchoCreep Discord API beacon from non-browser process (Webworm 2025) Bespoke c2 · hunting DSΣPDDCS [LLM] GraphWorm OneDrive /createUploadSession C2 from non-Office process Bespoke c2 · hunting DSΣPDDCS [LLM] Mini Shai-Hulud C2 backchannel: python polling GitHub commit search for 'firedalazer' Bespoke c2 · alerting DSPDDCS [LLM] BirdCall RokRAT cloud-storage C2 beacon (Dropbox/pCloud) from non-browser process Bespoke c2 · hunting DSPDDCS [LLM] Mini Shai-Hulud 'OhNoWhatsGoingOnWithGitHub' dead-drop keyword in outbound URL Bespoke c2 · alerting DSΣPDD [LLM] Svix Ingest webhook exfiltration relay (src_3387PLMB2uhXOBe3Q8sHu) Bespoke exfiltration · alerting DSΣPDDCS [LLM] Non-browser process posting to Slack Web API (LaxGopher C2) Bespoke c2 · hunting DSPDDCS [LLM] Non-browser process posting to Discord API (RatGopher C2) Bespoke c2 · hunting DSPDDCS [LLM] Suspicious draft email manipulation against barrantaya.1010@outlook.com (BoxOfFriends Graph API C2) Bespoke c2 · hunting DSPDDCS [LLM] DNS/HTTP egress to CanisterWorm ICP canister C2 (tdtqy-oyaaa-aaaae-af2dq-cai) Bespoke c2 · alerting DSΣPDDCS [LLM] BeardShell C2: outbound to Icedrive cloud-storage API as non-browser process Bespoke c2 · alerting DSΣPDDCS [LLM] Covenant C2: outbound to Filen cloud-storage API as non-browser process Bespoke c2 · alerting DSΣPDDCS

Articles citing this technique (15)

crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-49
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66
high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery art-132
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-303
crit Webworm: New burrowing techniques art-413
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-468
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
crit GopherWhisper: A burrow full of malware art-484
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-566
crit Sednit reloaded: Back in the trenches art-596
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728