AML.T0072
Cyber Communication Channel

MITRE source definition

Adversaries may establish or use cyber communication channels for command and control. A channel may use any network protocol, service, repository, relay, or other intermediary and may operate synchronously or asynchronously.

See the ATT&CK Command and Control tactic for techniques describing specific protocols, services, relays, tunneling methods, and communication patterns.

Source modified 2026-08-31. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.

Parent, sub-techniques and ATT&CK references

No explicit relationship in this pinned source.

Source-backed defensive context

MITRE mitigations

No explicit relationship in this pinned source.

MITRE case studies

• AML.CS0027 Organization Confusion on Hugging Face · Exercise
• AML.CS0031 Malicious Models on Hugging Face · Incident
• AML.CS0052 LLMSmith: RCE Vulnerabilities in LLM-Integrated Applications · Exercise
• AML.CS0065 Model Namespace Reuse Supply Chain Attack · Exercise
• AML.CS0068 Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure · Incident

These are explicit source relationships, not independently reproduced incidents or validated detection coverage.

Simulation and telemetry boundary

This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.

For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.

Provenance and attribution

Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0

Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.

No explicit relationship in this pinned source.