tfMITRE ATT&CK technique

Application Layer Protocol T1071

Tactic: Command and Control
Platforms: Linux, macOS, Windows, Network Devices, ESXi
Version: 2.4
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: Duane Michael

Sub-techniques 5104 rules across the family · 13 mapped directly to T1071 · 4 of 5 carry rules

.001Web Protocols57 .002File Transfer Protocols1 .003Mail Protocols3 .004DNS32 .005Publish/Subscribe Protocols0

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware74th pct

Tools & malware74th percentile · 74% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 19%

Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.

Application Layer Protocol MITRE reference T1071

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Velvet AntG1047 ↗

Has used reverse SSH tunnels to communicate to victim devices.1

created 2025-03-141 reference

INC RansomG1032 ↗

Has used valid accounts over RDP to connect to targeted systems.1

created 2024-06-061 referenceaka GOLD IONIC

TeamTNTG0139 ↗

Has used an IRC bot for C2 communications.1

created 2021-10-011 reference

RockeG0106 ↗

Issued wget requests from infected systems to the C2.1

created 2020-05-261 reference

Magic HoundG0059 ↗

Malware has used IRC for C2.1 2

created 2018-01-162 referencesaka TA453

All 5 groups for this technique

Offense vs defense T1071

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 5

first rule: 2019 Q4 · 1 of 1 campaigns plotted

Application Layer Protocol detection strategy DET0444

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Command and Control Over Application Layer Protocols

Enterprise

4 platforms

AN1225 · Windows

Detects suspicious usage of common application-layer protocols (e.g., HTTP, HTTPS, DNS, SMB) by abnormal processes, with high outbound byte counts or irregular ports, possibly indicating command and control or data exfiltration.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	http, dns, smb, ssl logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProtocolList	Limit detection to app-layer protocols of interest: HTTP, DNS, SSL, SMB, RDP
DataVolumeThreshold	Detects asymmetric communication volume (e.g., >90% outbound)
UnusualProcessList	Track processes not normally associated with network activity

AN1226 · Linux

Detects suspicious curl, wget, or custom socket traffic that leverages DNS, HTTPS, or IRC-style protocols with unbalanced traffic or beacon-like intervals.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic ContentDC0085	NSM:Flow	dns, ssl, conn

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
KnownPortsToMonitor	Uncommon ports for HTTPS, IRC, DNS (e.g., 8443, 5353)
BeaconTimingThreshold	Detect intervals of outbound traffic within fixed timeframes

AN1227 · macOS

Detects applications using abnormal protocols or high volume traffic not previously associated with the process image, such as Automator or AppleScript invoking curl or python sockets.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	macos:unifiedlog	log stream
Network Traffic FlowDC0078	macos:osquery	socket_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SocketParentProcessMatch	Non-browser processes opening sockets to external IPs
DataFlowImbalanceRatio	High outbound/inbound ratio indicating C2 beacon

AN1228 · Network Devices

Detects application-layer tunneling or unauthorized app protocols like DNS-over-HTTPS, embedded C2 in TLS/HTTP headers, or misused SMB traffic crossing VLANs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic ContentDC0085	NSM:Flow	conn.log, http.log, dns.log, ssl.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AppProtocolAbusePattern	Detects DNS tunneling, encrypted HTTP C2, or malformed headers
NorthSouthEgressFilter	Monitor internal hosts talking externally using internal protocols (e.g., SMB)

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Telnet C2

windows

PowerShell

—

An adversary may establish Telnet communication from a compromised endpoint to a command and control (C2) server in order to carry out additional attacks on objectives.

Input arguments

Name	Type	Default	Description
server_ip	url	127.0.0.1	C2 server IP or URL
client_path	path	PathToAtomicsFolder\T1071\bin\telnet_client.exe	Client agent path
server_port	integer	23	C2 server port

Attack command

#{client_path} #{server_ip} --port #{server_port}

Prerequisite

A command and control (C2) server can be established by running PathToAtomicsFolder\T1071\bin\telnet_server.exe on a specified server with a specified IP that must be reachable by a client (telnet_client.exe)

Check

$connection = Test-NetConnection -ComputerName #{server_ip} -Port #{server_port}
if ($connection.TcpTestSucceeded) {exit 0} else {exit 1}

Satisfy

Write-Host "Setup C2 server manually"

GUIDa0ac9a64-8145-4546-894b-80fc7c745593

Tests from Atomic Red Team (MIT licence) · technique definition

Application Layer Protocol detections T1071

13 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 19%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs