VOID MANTICOREG1055 ↗
Has utilized HTTPS for communication to C2 domains.1
tfMITRE ATT&CK sub-technique
Web Protocols T1071.001
sub-technique of T1071 Application Layer Protocol
- Tactic
- Command and Control
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Version
- 1.5
- Created
- 15 March 2020
- Last modified
- 12 May 2026
- Contributors
- TruKno; Don Le, Stifel Financial
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
57
Threat groupsTop 1%
Threat groups99th percentile · 99% of ATT&CK techniques have this many threat groups attributed or fewer.21
CampaignsTop 1%
Campaigns100th percentile · 100% of ATT&CK techniques have this many campaigns recorded or fewer.344
Tools & malwareTop 1%
Tools & malware100th percentile · 100% of ATT&CK techniques have this many tools implementing them or fewer.57
Detection rulesTop 3%
Detection rules97th percentile · 97% of ATT&CK techniques have this many detection rules written or fewer.Web Protocols MITRE reference T1071.001
Top 1%of all ATT&CK techniques for number of groups
57 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Medusa GroupG1051 ↗
Has communicated through reverse or bind shells over port 443 (HTTPS).1
APT42G1044 ↗
Has used tools such as NICECURL with command and control communication taking place over HTTPS.1
BlackByteG1043 ↗
Collected victim device information then transmitted this via HTTP POST to command and control infrastructure.1
RedEchoG1042 ↗
Network activity is associated with SSL traffic via TCP 443 and proxied HTTP traffic over non-standard ports.1
Sea TurtleG1041 ↗
Connected over TCP using HTTP to establish command and control channels.1
All 57 groups for this technique · 6 newest in this preview
21 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors issued HTTP POST requests to web shells with spoofed or empty Referrer headers, to circumvent authorization controls.12345
Versa Director Zero Day ExploitationC0039 ↗
Established HTTPS communications from adversary-controlled SOHO devices over port 443 with compromised Versa Director servers.1
Operation MidnightEclipseC0048 ↗
During Operation MidnightEclipse, threat actors used wget via HTTP to retrieve payloads.12
Quad7 ActivityC0055 ↗
Has used the same User Agents of Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko and Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36 combined with a reference to the Microsoft Azure PowerShell Application ID 1950a258-227b-4e31-a9cf-717495945fc2 in their sign-in attempts.1
ArcaneDoorC0046 ↗
Command and control activity was conducted through HTTP.1
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda used HTTP POST messages for command and control from PlugX installations during RedDelta Modified PlugX Infection Chain Operations.1
All 21 campaigns for this technique · 6 newest in this preview
344 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Kali365's desktop client has made Microsoft Graph API calls using the distinct User-Agent string kali365-live/1.0.0 to access victim mailboxes and enumerate account data following OAuth token capture.1
Mini Shai-HuludS9043 ↗
Has has exfiltrated data through the use of HTTPS POST requests to C2 domains.12
TeamPCP Cloud StealerS9041 ↗
Has used curl to upload stolen data to attacker controlled domains.123
RustyWaterS9037 ↗
Has used the Rust request library for HTTP C2 communication.1
LAMEHUGS9035 ↗
Can use HTTP POST requests to exfiltrate data from compromised hosts to C2.1
Tsundere BotnetS9034 ↗
Has obtained the WebSocket C2 address by making remote procedure call (RPC) APIs to Ethereum blockchain nodes.12
All 344 software entries for this technique · 6 newest in this preview
Offense vs defense T1071.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 20Sigma rules (cumulative) · 42Splunk ESCU (cumulative) · 15
first rule: 2017 Q1 · 20 of 21 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)Web Protocols detection strategy DET0027
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
5 platforms
AN0075 · Windows
Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | http.log, ssl.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessNameExclusions | Filter out legitimate browser/network utilities |
| UserAgentAnomalies | Detect non-browser user-agents or spoofed headers |
| OutboundByteRatioThreshold | Flag when outbound > inbound volume by 90%+ |
AN0076 · Linux
Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Network Traffic ContentDC0085 | NSM:Flow | http.log, conn.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLinePatternMatch | curl or wget in scripts with suspicious domains or silent flags |
| BeaconIntervalWindow | Fixed-timed HTTP callbacks with 60±5s jitter |
AN0077 · macOS
Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | macos:unifiedlog | log stream --predicate |
| Network Traffic FlowDC0078 | macos:osquery | socket_events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SuspiciousParentProcess | Non-browser parent of web traffic (e.g., AppleScript, bash) |
| URIEntropyThreshold | Unusually encoded data in GET/POST URIs |
AN0078 · ESXi
Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | esxi:shell | /root/.ash_history or /etc/init.d/* |
| Network Traffic ContentDC0085 | NSM:Flow | SPAN or port-mirrored HTTP/S |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ShellScriptMatch | Match on commands like wget https://*, curl -s |
| ExternalConnectionFilter | Public IPs or external DNS hostnames |
AN0079 · Network Devices
Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic ContentDC0085 | NSM:Flow | http.log, ssl.log, websocket.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| HeaderEncodingPattern | Base64, hex, or UTF-16 encoding in URI, cookie, or host |
| TLSFingerprintMismatch | JA3 hash deviation from known clients |
Restrict and monitor outbound web traffic (HTTP/HTTPS) from critical servers to only approved destinations. Limiting the ability to initiate outbound HTTP/HTTPS connections, especially from public-facing servers, can prevent attackers from using tools like curl or wget to communicate with external C2 servers or download malicious payloads.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Tests3ExecutorsPowerShell 1 · cmd 1 · sh 1Need elevation0 of 3Have prerequisites1Have cleanup0Platformswindows, linux, macos
Tests from Atomic Red Team (MIT licence) · technique definition