THREATNOIR
Subscribe
MITRE ATT&CK · T1071.001

Web Protocols

MITRE · cited in 18 of our lessons

Explanation

What attackers do. Attackers use web protocols such as HTTP and HTTPS for command and control, so their traffic looks like ordinary browsing. This is one of the most common Command and Control methods because web traffic is allowed almost everywhere.

How to defend. Send all web traffic through a proxy, block servers from browsing the internet directly, and use category and reputation filtering. Where policy allows, inspect TLS traffic and record headers such as user agents and server names. Link proxy logs to endpoint data so you know which process made each request.

Signs to look for. Look for regular beacon intervals, rare user agents, requests to newly registered or uncategorised domains, and non-browser processes making web requests. A common gap is that HTTPS hides content, so detection must rely on metadata and timing.

Open the technique on MITRE ATT&CK
The official text
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 18.