Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSometimes—but only when the attacker’s command-and-control (C2) channel depends on the blocked service. Blocking Outlook or OneDrive can disrupt that route; it does not prove an infected device is clean or prevent an attacker from switching to another cloud service or communication channel.
How cloud-service C2 works
Command-and-control is the communication path an attacker uses to send instructions to a compromised device and receive information back. MITRE ATT&CK describes the Web Service technique (T1102) as using legitimate external web services to relay data. Familiar services can make malicious traffic look more like expected activity, while encrypted connections can make its contents harder to inspect.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Network Security, Firewalls, and VPNs | $66.62 | Buy on Amazon |
| 2 |
|
Network Security, Firewalls, and VPNs: . (Issa) | $62.45 | Buy on Amazon |
| 3 |
|
TP-Link ER605, Wired Gigabit VPN Router | $49.99 | Buy on Amazon |
| 4 |
|
Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid | $33.89 | Buy on Amazon |
MITRE’s bidirectional communication sub-technique (T1102.002) includes OneDrive examples. It lists CloudDuke exchanging commands and stolen data through a Microsoft OneDrive account, and CreepyDrive as capable of using OneDrive for C2. These examples demonstrate that the method is possible; they do not show how common it is.
MITRE lists both technique pages as last modified on May 12, 2026. The cited examples concern OneDrive. They do not establish a specific Outlook-based C2 campaign or show that blocking Outlook alone is sufficient.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
What blocking a service can accomplish
A block can remove a service-dependent route if it actually covers the apps and endpoints the device can use to reach that service. That may interrupt command delivery or the return of stolen data over that route. It is a targeted containment measure, not a comprehensive C2 defense: an attacker may use another legitimate web service or a different channel.
The evidence available does not quantify how effective blocking Outlook or OneDrive is against C2. Nor does the recommendation to block unused public file shares mean every organization should block OneDrive. CISA’s alert recommends denying access to public file shares an organization does not use and names OneDrive as an example; it is a risk-reduction measure to weigh against business requirements.
Rank #2
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
Choose between blocking and controlled access
| Approach | What it can do | Limit or trade-off |
|---|---|---|
| Block an unneeded service | Remove a service-dependent route if the block covers the relevant access paths. | May disrupt legitimate work; does not block other services or channels. CISA’s recommendation concerns public file shares the organization does not use. |
| Allow access with targeted controls | Microsoft Defender for Cloud Apps session policies can block selected activities in configured apps. Microsoft also documents malware inspection for file uploads and downloads. | Coverage depends on configuration and applicable licensing or prerequisites. These controls are not documented as detecting every kind of service-based C2. |
Microsoft’s guidance on Defender for Cloud Apps describes policy-based controls, not a universal configuration that guarantees a complete service block. Organizations should account for applicable web access, desktop and mobile clients, and other approved routes when assessing whether a restriction has the intended scope.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why file scanning is not a C2-blocking guarantee
Microsoft 365’s built-in anti-malware engine scans eligible files uploaded to SharePoint, SharePoint Embedded, OneDrive, and Teams. Scanning is asynchronous, uses heuristics to determine which files are scanned, and does not automatically cover every file. Microsoft says the feature is intended to help contain viruses, not to serve as the environment’s single point of defense against malware. Its guidance was last updated September 4, 2025.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Safe Attachments for SharePoint, OneDrive, and Teams adds detonation in a virtual environment and can lock files identified as malicious. Microsoft says it applies to Defender for Office 365 Plan 1 and Plan 2 and Defender XDR. The guidance, last updated May 8, 2026, also says files are not all scanned; scanning is asynchronous and informed by sharing and guest activity, heuristics, and threat signals.
These features protect files under their documented conditions. They are not described as a way to prevent all C2 traffic through otherwise legitimate service activity, so file scanning should not replace access controls or investigation of a suspicious endpoint.
Quick Recap
Practical response for an organization
- Check business need. Identify whether Outlook, OneDrive, or another public file-sharing service is needed for approved workflows. Consider blocking access to services the organization does not use, consistent with CISA’s recommendation for unused public file shares.
- Contain the specific route where appropriate. If a service is not needed, restrict it using controls that cover the organization’s relevant access paths. If it must remain available, consider targeted app-activity and file-transfer policies rather than assuming the service is either entirely safe or entirely blocked.
- Investigate the endpoint. A service block does not establish that a device is clean. Pair restrictions with endpoint investigation and monitoring of cloud-app activity, especially where ordinary encrypted traffic could conceal misuse.
- Validate the policy’s effect. Confirm that the intended apps and routes are covered and that legitimate work still functions as required. The cited guidance does not provide a universal configuration or guarantee that a block will close every path.
What the evidence does—and does not—show
- Established: MITRE documents OneDrive-based C2 examples, and its broader web-service technique explains why legitimate services can be used as relays.
- Not established: The prevalence of OneDrive C2, a specific Outlook C2 campaign, or an effectiveness percentage for blocking either service.
- Practical implication: Treat service blocking as one scoped containment option. Combine it with appropriately configured controls and investigation rather than treating it as proof that C2 has stopped.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
