• Platformchevron right
  • Solutionschevron right
  • Modern NDRchevron right
  • Resourceschevron right
  • Companychevron right

DETECTION OVERVIEW

Mythic C&C Web UI Connection

Risk Factors

The Mythic framework is publicly available and is associated with pen testing, security assessments and known attack campaigns. Mythic provides a web-based user interface that enables an attacker to easily configure or interact with a persistent C&C channel through a web browser. You should examine unusual connections to the Mythic user interface to prevent critical or costly attacks.

Kill Chain

Command-and-Control

Risk Score

56

Detection diagram
Next in Command-and-Control: New External IoT Connection

Attack Background

Mythic is a post-compromise C&C framework. Mythic includes a web-based user interface that enables users to access and manage the Mythic software. An attacker can generate a Mythic agent, configure C&C traffic with a profile, and issue commands to Mythic agents through the interface.

Mitigation Options

Quarantine the device while checking for malware.

Block inbound and outbound traffic from suspicious hosts at the network perimeter.

Monitor and investigate unusual network activity for lateral movement or data exfiltration.

Implement network segmentation and the principle of least privilege to minimize the damage caused by a compromised device.

MITRE ATT&CK ID

What else can RevealX do for you?