[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1071":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1071","T1071","Application Layer Protocol",44,"MITRE","**What attackers do.** Attackers hide command and control traffic inside ordinary application protocols such as HTTP, HTTPS, DNS or mail protocols so it blends with legitimate traffic. This serves the Command and Control tactic.\n\n**How to defend.** Route outbound traffic through controlled egress points such as proxies and DNS resolvers, and block direct internet access from servers that do not need it. Inspect traffic where policy allows, and use threat intelligence and domain reputation to flag known bad destinations. Collect proxy, DNS and firewall logs and correlate them with the process that made each connection.\n\n**Signs to look for.** Watch for regular, beacon-like connections at fixed intervals, unusual user agents, rare or newly registered domains, and processes that do not normally talk to the internet doing so. The main gap is relying on port or protocol alone, since the traffic is designed to look normal.","Adversaries may communicate using OSI application layer protocols to avoid detection\u002Fnetwork filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nAdversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing\u002Fsubscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1071\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"critical-rce-dns-wallet-theft-container-escape-self-healing-malware-highlight-diverse-threat-week","Critical RCE, DNS Wallet Theft, Container Escape & Self-Healing Malware Highlight Diverse Threat Week","2026-10-15T20:20:52.553+00:00",{"slug":25,"title":26,"published_at":27},"malicious-ide-extensions-whatsapp-rat-and-exposed-c2-infrastructure-highlight-diverse-threat-landsca","Malicious IDE Extensions, WhatsApp RAT, and Exposed C2 Infrastructure Highlight Diverse Threat Landscape","2026-10-08T20:21:52.231+00:00",{"slug":29,"title":30,"published_at":31},"power-bi-abused-to-host-phishing-lures-deploying-rogue-remote-access-tools","Power BI Abused to Host Phishing Lures Deploying Rogue Remote Access Tools","2026-10-07T16:20:55.433+00:00",{"slug":33,"title":34,"published_at":35},"exposed-ai-servers-hijacked-for-cryptomining-via-poellm-malware","Exposed AI Servers Hijacked for Cryptomining via PoeLLM Malware","2026-10-07T16:20:21.445+00:00",{"slug":37,"title":38,"published_at":39},"malicious-vs-code-extensions-deliver-malware-loaders-via-themed-packages","Malicious VS Code Extensions Deliver Malware Loaders via Themed Packages","2026-10-02T16:21:36.884+00:00",{"slug":41,"title":42,"published_at":43},"needymantis-malware-exploits-supply-chain-foothold-for-long-term-espionage","NeedyMantis Malware Exploits Supply Chain Foothold for Long-Term Espionage","2026-09-28T18:22:15.689+00:00",{"slug":45,"title":46,"published_at":47},"pamstealer-macos-malware-uses-live-c2-decryption-and-fake-crypto-apps-to-evade-detection","PamStealer macOS Malware Uses Live C2 Decryption and Fake Crypto Apps to Evade Detection","2026-09-25T20:22:32.419+00:00",{"slug":49,"title":50,"published_at":51},"ai-driven-malware-operates-autonomously-using-llms-for-command-control","AI-Driven Malware Operates Autonomously Using LLMs for Command & Control","2026-09-22T13:20:42.503+00:00",{"slug":53,"title":54,"published_at":55},"fake-app-installers-deliver-blockchain-powered-rat-via-clickfix-campaign","Fake App Installers Deliver Blockchain-Powered RAT via ClickFix Campaign","2026-09-22T00:21:00.635+00:00",{"slug":57,"title":58,"published_at":59},"famoussparrow-apt-uses-stealthy-backdoor-to-target-us-political-interests-in-latin-america","FamousSparrow APT Uses Stealthy Backdoor to Target US Political Interests in Latin America","2026-09-17T20:20:21.882+00:00",{"slug":61,"title":62,"published_at":63},"china-linked-famoussparrow-targets-latin-american-governments-with-new-sparrowocky-backdoor","China-Linked FamousSparrow Targets Latin American Governments with New SparroWocky Backdoor","2026-09-17T17:20:25.364+00:00",{"slug":65,"title":66,"published_at":67},"bambootoken-malware-hijacks-legitimate-software-to-establish-covert-c2-via-mqtt","BambooToken Malware Hijacks Legitimate Software to Establish Covert C2 via MQTT","2026-09-15T16:21:24.994+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",35,{"slug":75,"name":76,"problem":77,"stories":78},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",18,{"slug":80,"name":81,"problem":82,"stories":83},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",9,{"slug":85,"name":86,"problem":87,"stories":88},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",8,{"slug":90,"name":91,"problem":92,"stories":93},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",7,{"slug":95,"name":96,"problem":97,"stories":98},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",6,[100,106,112,118,123,128,133,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","13","Control 13","Network Monitoring and Defense",34,{"family":107,"item":108,"code":109,"title":110,"together":111},"nist-800-53","si-3","SI-3","Malicious Code Protection",27,{"family":113,"item":114,"code":115,"title":116,"together":117},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",20,{"family":107,"item":119,"code":120,"title":121,"together":122},"sc-7","SC-7","Boundary Protection",17,{"family":101,"item":124,"code":125,"title":126,"together":127},"7","Control 7","Continuous Vulnerability Management",15,{"family":101,"item":129,"code":130,"title":131,"together":132},"9","Control 9","Email and Web Browser Protections",12,{"family":101,"item":134,"code":135,"title":136,"together":132},"2","Control 2","Inventory and Control of Software Assets",{"family":107,"item":138,"code":139,"title":140,"together":132},"ir-4","IR-4","Incident Handling"]