Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.[1]
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During FrostyGoop Incident, the adversary initiated Layer Two Tunnelling Protocol (L2TP) connections to Moscow-based IP addresses.1
2024
All 1 campaigns for this technique
10 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Command and Control Over Application Layer Protocols
Enterprise
4 platforms
AN1225 · Windows
Detects suspicious usage of common application-layer protocols (e.g., HTTP, HTTPS, DNS, SMB) by abnormal processes, with high outbound byte counts or irregular ports, possibly indicating command and control or data exfiltration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ProtocolList
Limit detection to app-layer protocols of interest: HTTP, DNS, SSL, SMB, RDP
DataVolumeThreshold
Detects asymmetric communication volume (e.g., >90% outbound)
UnusualProcessList
Track processes not normally associated with network activity
AN1226 · Linux
Detects suspicious curl, wget, or custom socket traffic that leverages DNS, HTTPS, or IRC-style protocols with unbalanced traffic or beacon-like intervals.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
KnownPortsToMonitor
Uncommon ports for HTTPS, IRC, DNS (e.g., 8443, 5353)
BeaconTimingThreshold
Detect intervals of outbound traffic within fixed timeframes
AN1227 · macOS
Detects applications using abnormal protocols or high volume traffic not previously associated with the process image, such as Automator or AppleScript invoking curl or python sockets.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
SocketParentProcessMatch
Non-browser processes opening sockets to external IPs
DataFlowImbalanceRatio
High outbound/inbound ratio indicating C2 beacon
AN1228 · Network Devices
Detects application-layer tunneling or unauthorized app protocols like DNS-over-HTTPS, embedded C2 in TLS/HTTP headers, or misused SMB traffic crossing VLANs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Tests1Executorspowershell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Telnet C2
windows
powershell
—
1
—
An adversary may establish Telnet communication from a compromised endpoint to a command and control (C2) server in order to carry out additional attacks on objectives.
Inputs
Name
Description
Type
Default Value
server_ip
C2 server IP or URL
url
127.0.0.1
client_path
Client agent path
path
PathToAtomicsFolder\T1071\bin\telnet_client.exe
server_port
C2 server port
integer
23
Attack Commandsrun with powershell
#{client_path} #{server_ip} --port #{server_port}
Dependenciesrun with powershell
Description
A command and control (C2) server can be established by running PathToAtomicsFolder\T1071\bin\telnet_server.exe on a specified server with a specified IP that must be reachable by a client (telnet_client.exe)
The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified. (...)