Attack scenario
Malware and Command and Control
Malicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
Why this scenario matters
This view connects the attack path with preventive, detective, response, and recovery controls and helps identify gaps between technologies.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Command And Control
- Execution
- Persistence
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
- T1027 Obfuscated Files or Information
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1059 Command and Scripting Interpreter
- T1071 Application Layer Protocol
- T1090 Proxy
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.