Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1102.002

T1102.002Bidirectional Communication

T1102.002 — Bidirectional Communication is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 18 detection use cases covering it and 11 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
18Use cases
11Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1102 · Web Service

Use cases covering this technique (18)

[WEEKLY] Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains Internal install · alerting DSPDDCSCW [WEEKLY] Script Interpreter or Package-Install Hook Egress to Free-Tier Edge SaaS Within 5 Minutes of Process Start Internal c2 · alerting DSΣPDD Potential Telegram API Request Via CommandLine ESCU actions · hunting P Windows DNS Query Request by Telegram Bot API ESCU actions · hunting P [LLM] ForestTiger/MISTPEN C2 to Enveil-impersonation domains and hijacked-infrastructure IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Telegram bot C2 / crypto-wallet exfiltration from script-host process Bespoke actions · hunting DSΣPDDCS [LLM] macOS.Gaslight Telegram Bot API C2 polling from non-browser process Bespoke c2 · hunting DSΣPCS [LLM] EchoCreep Discord API beacon from non-browser process (Webworm 2025) Bespoke c2 · hunting DSΣPDDCS [LLM] GraphWorm OneDrive /createUploadSession C2 from non-Office process Bespoke c2 · hunting DSΣPDDCS [LLM] Mini Shai-Hulud C2 backchannel: python polling GitHub commit search for 'firedalazer' Bespoke c2 · alerting DSPDDCS [LLM] BirdCall RokRAT cloud-storage C2 beacon (Dropbox/pCloud) from non-browser process Bespoke c2 · hunting DSPDDCS [LLM] Mini Shai-Hulud 'OhNoWhatsGoingOnWithGitHub' dead-drop keyword in outbound URL Bespoke c2 · alerting DSΣPDD [LLM] Svix Ingest webhook exfiltration relay (src_3387PLMB2uhXOBe3Q8sHu) Bespoke exfiltration · alerting DSΣPDDCS [LLM] Non-browser process posting to Slack Web API (LaxGopher C2) Bespoke c2 · hunting DSPDDCS [LLM] Non-browser process posting to Discord API (RatGopher C2) Bespoke c2 · hunting DSPDDCS [LLM] Suspicious draft email manipulation against barrantaya.1010@outlook.com (BoxOfFriends Graph API C2) Bespoke c2 · hunting DSPDDCS [LLM] BeardShell C2: outbound to Icedrive cloud-storage API as non-browser process Bespoke c2 · alerting DSΣPDDCS [LLM] Covenant C2: outbound to Filen cloud-storage API as non-browser process Bespoke c2 · alerting DSΣPDDCS

Articles citing this technique (11)

crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-352
crit Webworm: New burrowing techniques art-459
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-513
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
crit GopherWhisper: A burrow full of malware art-529
crit Sednit reloaded: Back in the trenches art-629
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758