AML.T0072
Reverse Shell
Description
Adversaries may utilize a reverse shell to communicate and control the victim system. Typically, a user uses a client to connect to a remote machine which is listening for connections. With a reverse shell, the adversary is listening for incoming connections initiated from the victim system.
Honesty-tier rationale
A working command-and-control channel is both infrastructure-heavy and unsafe to hand out; explained with an architecture diagram, no functional C2.