Which Kill Chain stage establishes two-way communication between the victim and an adversary-controlled server and may use encryption to hide the channel?

Which Kill Chain stage establishes two-way communication between the victim and an adversary-controlled server and may use encryption to hide the channel?

• A. Tactics
• B. Command and Control
• C. Techniques
• D. Procedures

Answer: (B)

Maintaining remote control over compromised hosts through a covert channel is the key idea. In the cyber kill chain, the stage that does this is Command and Control. It establishes two-way communication between the victim's system and an adversary‑controlled server, so the attacker can issue commands, receive data, and send updates or new instructions. Encrypting the channel is a common technique here to hide the traffic from defenders, making the beaconing, data exfiltration, and command traffic harder to spot. You might see the malware reach out to a C2 server over encrypted protocols (like HTTPS or other tunneled methods) to keep control hidden. Other terms like tactics, techniques, or procedures are broad labels for classes of actions or methods, not the specific mechanism by which an attacker maintains ongoing control over a compromised host.

Maintaining remote control over compromised hosts through a covert channel is the key idea. In the cyber kill chain, the stage that does this is Command and Control. It establishes two-way communication between the victim's system and an adversary‑controlled server, so the attacker can issue commands, receive data, and send updates or new instructions. Encrypting the channel is a common technique here to hide the traffic from defenders, making the beaconing, data exfiltration, and command traffic harder to spot. You might see the malware reach out to a C2 server over encrypted protocols (like HTTPS or other tunneled methods) to keep control hidden. Other terms like tactics, techniques, or procedures are broad labels for classes of actions or methods, not the specific mechanism by which an attacker maintains ongoing control over a compromised host.