tfMITRE ATT&CK sub-technique

Socket Filters T1205.002

sub-technique of T1205 Traffic Signaling

Tactics: Persistence, Stealth, Command and Control
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 30 September 2022
Last modified: 12 May 2026
Contributors: CrowdStrike; Tim (Wadhwa-)Brown

Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the libpcap library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Socket Filters MITRE reference T1205.002

62nd pctamong all ATT&CK techniques for number of tools

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

CASTLETAPS1224 ↗

Can listen for a specialized ICMP packet for activation on compromised network devices.1

created 2025-06-16MALWAREcarried by 1 group

BPFDoorS1161 ↗

Uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 (ssh), 80 (http), and 443 (https). When BPFDoor finds a packet containing its “magic” bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields.1 2

created 2024-09-20MALWARE

PITSTOPS1123 ↗

Can listen and evaluate incoming commands on the domain socket, created by PITHOOK malware, located at /data/runtime/cockpit/wd.fd for a predefined magic byte sequence. PITSTOP can then duplicate the socket for further communication over TLS.1

created 2024-03-13MALWARE

PenquinS0587 ↗

Installs a TCP and UDP filter on the eth0 interface.1

created 2021-03-11MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1205.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Socket Filters detection strategy DET0162

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Socket-filter trigger → on-host raw-socket activity → reverse connection (T1205.002)

Enterprise

3 platforms

AN0462 · Windows

Adversary installs/uses packet-capture or raw-socket capability (WinPcap/Npcap, wpcap/packet DLLs or raw socket attach) and sets a filter. A crafted inbound packet is observed; within a short window the host process that loaded capture libraries initiates an outbound connection (e.g., reverse shell) to the packet origin.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Service CreationDC0060	WinEventLog:System	EventCode=7045
Driver LoadDC0079	WinEventLog:Sysmon	EventCode=6
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	Single, low-volume inbound packet (REJ/S0/OTH or uncommon dport/protocol) from src_ip followed by outbound SF connection to src_ip.

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Seconds to correlate inbound trigger → process library load/driver start → outbound connect (default 120s).
CaptureLibIndicators	DLL/driver names to match (wpcap.dll, packet.dll, npcap.sys, npf.sys) – extend for EDR drivers in your fleet.
AllowedInstallers	Signed/expected processes allowed to install/start Npcap (software distribution tools).
ReversePorts	Likely egress ports to watch after trigger (4444, 53, 80/443, 8080, high ephemeral).

AN0463 · Linux

Process creates a raw/packet socket and attaches a (e)BPF filter (setsockopt SO_ATTACH_FILTER/ATTACH_BPF or bpf(BPF_PROG_LOAD)). Immediately after a matching inbound packet, the same process binds/connects outward to a remote host (reverse shell or beacon).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	socket(AF_PACKET\|AF_INET, SOCK_RAW, ), setsockopt(… SO_ATTACH_FILTER\|SO_ATTACH_BPF …), bpf(cmd=BPF_PROG_LOAD), open/openat path="/dev/bpf" (BSD/macOS-like) or setcap cap_net_raw.
Network Connection CreationDC0082	linux:osquery	family=AF_PACKET or protocol raw; process name not in allowlist.
Network Traffic ContentDC0085	NSM:Flow	Rare inbound packet characteristics (ICMP/UDP/TCP to uncommon port) from src_ip followed ≤TimeWindow by outbound SF from same host to src_ip.

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Flag raw-socket activity outside privileged daemons (root-only by default).
MinPayloadEntropy	If using packet content (Zeek), treat high-entropy single-packet triggers as suspicious.
AFPacketAllowList	System services allowed to open AF_PACKET (dhclient, keepalived, LLDP, monitoring agents).

AN0464 · macOS

Process opens /dev/bpf* (libpcap) or loads NetworkExtension filter, then after a crafted inbound packet the same process initiates an outbound connection to the trigger origin.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	OpenBSM:AuditTrail	open/openat of /dev/bpf*; ioctl BIOCSETF-like operations.
Network Connection CreationDC0082	macos:unifiedlog	First outbound connection from the same PID/user shortly after an inbound trigger.
Network Traffic ContentDC0085	NSM:Flow	Inbound one-off packet to uncommon port → outbound SF to same src_ip within TimeWindow.

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BPFDevicePath	Alternate BPF device paths if customized (default /dev/bpf*).
DeveloperMode	Relax thresholds on known developer tooling hosts (Xcode, instrumenting tools).

Socket Filters detections T1205.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs