THREATNOIR
Subscribe
MITRE ATT&CK · T1071

Application Layer Protocol

MITRE · cited in 44 of our lessons

Explanation

What attackers do. Attackers hide command and control traffic inside ordinary application protocols such as HTTP, HTTPS, DNS or mail protocols so it blends with legitimate traffic. This serves the Command and Control tactic.

How to defend. Route outbound traffic through controlled egress points such as proxies and DNS resolvers, and block direct internet access from servers that do not need it. Inspect traffic where policy allows, and use threat intelligence and domain reputation to flag known bad destinations. Collect proxy, DNS and firewall logs and correlate them with the process that made each connection.

Signs to look for. Watch for regular, beacon-like connections at fixed intervals, unusual user agents, rare or newly registered domains, and processes that do not normally talk to the internet doing so. The main gap is relying on port or protocol alone, since the traffic is designed to look normal.

Open the technique on MITRE ATT&CK
The official text
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 44.