# Can attackers hide command-and-control inside trusted cloud services?

Yes, and they do, because traffic to a well-known cloud service rarely gets blocked or questioned. Malware can fetch instructions from a file in a public cloud storage account, a shared document, a code-hosting site, a messaging app's bot interface or a content-delivery network, and send stolen data back the same way. To a firewall that judges destinations by reputation, it looks like an ordinary employee using a popular service. What still gives it away is behaviour. A program checking a cloud file at regular intervals, day and night, from a device whose user is not working, has a rhythm that people do not; uploads may be unusually large for that device; and the client fingerprint in the TLS handshake may not match a browser or the service's official app. Practical steps: allow only the cloud services the business uses, by tenant where your tools allow it, and investigate devices that talk to personal accounts of popular services. NetSenX detects beaconing and unusual outbound volume on every plan, whatever the destination, and TLS fingerprints from the Starter plan where the agent captures packets.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/can-attackers-use-trusted-cloud-services-for-command-and-control

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [How do we tell a legitimate cloud sync from data theft?](https://netsenx.com/en/faq/how-to-tell-a-cloud-sync-from-data-theft)
- [Can we see if a leaving employee uploads company data to the cloud?](https://netsenx.com/en/faq/can-we-see-if-a-leaving-employee-uploads-company-data-to-the-cloud)
- [Can ransomware reach the files we keep in the cloud?](https://netsenx.com/en/faq/can-ransomware-reach-our-cloud-files)
- [Is our SaaS data backed up by the provider?](https://netsenx.com/en/faq/is-our-saas-data-backed-up-by-the-provider)
- [How do we secure our Microsoft 365 or Google Workspace accounts?](https://netsenx.com/en/faq/how-to-secure-microsoft-365-and-google-workspace-accounts)