[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1071-001":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1071-001","T1071.001","Web Protocols",18,"MITRE","**What attackers do.** Attackers use web protocols such as HTTP and HTTPS for command and control, so their traffic looks like ordinary browsing. This is one of the most common Command and Control methods because web traffic is allowed almost everywhere.\n\n**How to defend.** Send all web traffic through a proxy, block servers from browsing the internet directly, and use category and reputation filtering. Where policy allows, inspect TLS traffic and record headers such as user agents and server names. Link proxy logs to endpoint data so you know which process made each request.\n\n**Signs to look for.** Look for regular beacon intervals, rare user agents, requests to newly registered or uncategorised domains, and non-browser processes making web requests. A common gap is that HTTPS hides content, so detection must rely on metadata and timing.","Adversaries may communicate using application layer protocols associated with web traffic to avoid detection\u002Fnetwork filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP\u002FS and WebSocket that carry web traffic may be very common in environments. HTTP\u002FS packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1071\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","2026-10-15T12:20:40.147+00:00",{"slug":25,"title":26,"published_at":27},"needymantis-malware-enables-stealthy-long-term-persistence-via-dll-sideloading","NeedyMantis Malware Enables Stealthy Long-Term Persistence via DLL Sideloading","2026-09-28T22:21:46.583+00:00",{"slug":29,"title":30,"published_at":31},"iran-linked-handala-backdoor-uses-telegram-c2-and-defender-evasion-to-steal-credentials","Iran-Linked Handala Backdoor Uses Telegram C2 and Defender Evasion to Steal Credentials","2026-09-18T04:21:18.568+00:00",{"slug":33,"title":34,"published_at":35},"bambootoken-malware-hijacks-systems-using-mqtt-protocol-for-stealthy-c2","BambooToken Malware Hijacks Systems Using MQTT Protocol for Stealthy C2","2026-09-15T16:21:57.294+00:00",{"slug":37,"title":38,"published_at":39},"webrtc-tunnels-exploit-whitelisted-video-platforms-to-bypass-network-controls","WebRTC Tunnels Exploit Whitelisted Video Platforms to Bypass Network Controls","2026-09-14T20:20:24.301+00:00",{"slug":41,"title":42,"published_at":43},"toy-ghouls-deploy-mqtt-and-matrix-based-backdoors-against-russian-orgs","Toy Ghouls Deploy MQTT and Matrix-Based Backdoors Against Russian Orgs","2026-09-04T12:21:34.318+00:00",{"slug":45,"title":46,"published_at":47},"apt28-deploys-hookedge-backdoor-via-malicious-word-documents-against-european-governments","APT28 Deploys HOOKEDGE Backdoor via Malicious Word Documents Against European Governments","2026-08-28T10:21:27.666+00:00",{"slug":49,"title":50,"published_at":51},"quicagent-backdoor-exploits-living-off-the-land-techniques-in-myanmar-espionage-campaign","QUICAgent Backdoor Exploits Living-off-the-Land Techniques in Myanmar Espionage Campaign","2026-08-24T14:21:51.882+00:00",{"slug":53,"title":54,"published_at":55},"kimwolf-botnet-resurfaces-with-blockchain-c2-and-browser-camouflage","Kimwolf Botnet Resurfaces with Blockchain C2 and Browser Camouflage","2026-08-12T02:20:23.75+00:00",{"slug":57,"title":58,"published_at":59},"kimwolf-v7-botnet-disguises-ddos-traffic-as-legitimate-http2-browsing","Kimwolf v7 Botnet Disguises DDoS Traffic as Legitimate HTTP\u002F2 Browsing","2026-08-11T22:21:57.848+00:00",{"slug":61,"title":62,"published_at":63},"espionage-framework-abuses-google-services-and-dns-for-covert-c2-communication","Espionage Framework Abuses Google Services and DNS for Covert C2 Communication","2026-08-11T12:21:49.705+00:00",{"slug":65,"title":66,"published_at":67},"chaos-ransomware-hides-c2-traffic-in-legitimate-browser-sessions-via-msarat","Chaos Ransomware Hides C2 Traffic in Legitimate Browser Sessions via msaRAT","2026-07-23T16:22:04.374+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",14,{"slug":75,"name":76,"problem":77,"stories":78},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",11,{"slug":80,"name":81,"problem":82,"stories":83},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",8,{"slug":85,"name":86,"problem":87,"stories":88},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",5,{"slug":90,"name":91,"problem":92,"stories":88},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":94,"name":95,"problem":96,"stories":97},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",3,[99,104,109,113,119,123,127,131],{"family":100,"item":101,"code":102,"title":103,"together":9},"cis","13","Control 13","Network Monitoring and Defense",{"family":105,"item":106,"code":107,"title":108,"together":73},"nist-800-53","sc-7","SC-7","Boundary Protection",{"family":100,"item":110,"code":111,"title":112,"together":78},"9","Control 9","Email and Web Browser Protections",{"family":114,"item":115,"code":116,"title":117,"together":118},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",9,{"family":105,"item":120,"code":121,"title":122,"together":118},"si-4","SI-4","System Monitoring",{"family":105,"item":124,"code":125,"title":126,"together":83},"si-3","SI-3","Malicious Code Protection",{"family":105,"item":128,"code":129,"title":130,"together":83},"ac-17","AC-17","Remote Access",{"family":100,"item":132,"code":133,"title":134,"together":135},"4","Control 4","Secure Configuration of Enterprise Assets and Software",7]