Application Layer Protocol

T1071

Technique with 5 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.

Detection rules85

Rules on DetectionCode tagged with T1071 or one of its sub-techniques.

Sigma45

Rule	Level	Log source	Technique
Cobalt Strike DNS Beaconing	critical	NULL / dns	T1071.004
HackTool - BabyShark Agent Default URL Pattern	critical	NULL / proxy	T1071.001
PwnDrp Access	critical	NULL / proxy	T1071.001
Silence.EDA Detection	critical	windows / ps_script	T1071.004
Suspicious Cobalt Strike DNS Beaconing - DNS Client	critical	windows / NULL	T1071.004
Suspicious Cobalt Strike DNS Beaconing - Sysmon	critical	windows / dns_query	T1071.004
APT User Agent	high	NULL / proxy	T1071.001
Bitsadmin to Uncommon IP Server Address	high	NULL / proxy	T1071.001
Bitsadmin to Uncommon TLD	high	NULL / proxy	T1071.001
Crypto Miner User Agent	high	NULL / proxy	T1071.001
DNS Exfiltration and Tunneling Tools Execution	high	windows / process_creation	T1071.004
DNS Query by Finger Utility	high	windows / dns_query	T1071.004
DNS TXT Answer with Possible Execution Strings	high	NULL / dns	T1071.004
Exploit Framework User Agent	high	NULL / proxy	T1071.001
HackTool - CobaltStrike Malleable Profile Patterns - Proxy	high	NULL / proxy	T1071.001
HackTool - Empire UserAgent URI Combo	high	NULL / proxy	T1071.001
HackTool - SILENTTRINITY Stager DLL Load	high	windows / image_load	T1071
HackTool - SILENTTRINITY Stager Execution	high	windows / process_creation	T1071
Malware User Agent	high	NULL / proxy	T1071.001
Network Connection Initiated via Finger.EXE	high	windows / network_connection	T1071.004
Outbound Network Connection Initiated By Microsoft Dialer	high	windows / network_connection	T1071.001
Raw Paste Service Access	high	NULL / proxy	T1071.001
Renamed Visual Studio Code Tunnel Execution	high	windows / process_creation	T1071.001
Suspicious User Agent	high	NULL / proxy	T1071.001
Wannacry Killswitch Domain	high	NULL / dns	T1071.001
Windows WebDAV User Agent	high	NULL / proxy	T1071.001
Change User Agents with WebRequest	medium	windows / ps_script	T1071.001
Cloudflared Tunnels Related DNS Requests	medium	windows / dns_query	T1071.001
DNS Query To Common Malware Hosting and Shortener Services	medium	windows / dns_query	T1071.004
DNS Query To Devtunnels Domain	medium	windows / dns_query	T1071.001
DNS Query To Visual Studio Code Tunnels Domain	medium	windows / dns_query	T1071.001
Github Self-Hosted Runner Execution	medium	windows / process_creation	T1071
HTTP Request With Empty User Agent	medium	NULL / proxy	T1071.001
Potential Base64 Encoded User-Agent	medium	NULL / proxy	T1071.001
Potentially Suspicious Rundll32.EXE Execution of UDL File	medium	windows / process_creation	T1071
Suspicious Base64 Encoded User-Agent	medium	NULL / proxy	T1071.001
Suspicious Curl Change User Agents - Linux	medium	linux / process_creation	T1071.001
Suspicious DNS Query with B64 Encoded String	medium	NULL / dns	T1071.004
Suspicious Installer Package Child Process	medium	macos / process_creation	T1071 T1071.001
Telegram API Access	medium	NULL / proxy	T1071.001
Visual Studio Code Tunnel Execution	medium	windows / process_creation	T1071.001
Visual Studio Code Tunnel Service Installation	medium	windows / process_creation	T1071.001
Visual Studio Code Tunnel Shell Execution	medium	windows / process_creation	T1071.001
Windows PowerShell User Agent	medium	NULL / proxy	T1071.001
DNS Query Request By QuickAssist.EXE	low	windows / dns_query	T1071.001

Splunk40

Rule	Type	Risk	Data source	Technique
Cisco NVM - Osascript Network Connection for a Long Duration	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1071.001
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint	TTP	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1071.001
Cisco Secure Firewall - Connection to File Sharing Domain	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1071.001
Cisco Secure Firewall - High EVE Threat Confidence	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1071.001
Cisco Secure Firewall - High Priority Intrusion Classification	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1071
Cisco Secure Firewall - High Volume of Intrusion Events Per Host	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1071
Cisco Secure Firewall - Wget or Curl Download	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1071.001
Detect Outbound SMB Traffic	TTP	NULL	Cisco Secure Firewall Threat Defense Connection Event, Cisco Secure Access Firewall	T1071.002
Detect web traffic to dynamic domain providers	TTP	NULL		T1071.001
DNS Kerberos Coercion	TTP	NULL	Suricata, Sysmon EventID 22	T1071.004
DNS Query Length Outliers - MLTK	Anomaly	NULL		T1071.004
DNS Query Requests Resolved by Unauthorized DNS Servers	TTP	NULL		T1071.004
DNS record changed	TTP	NULL		T1071.004
Excessive DNS Failures	Anomaly	NULL		T1071.004
HTTP C2 Framework User Agent	TTP	NULL	Suricata	T1071.001
HTTP Duplicated Header	Anomaly	NULL	Suricata	T1071.001
HTTP Malware User Agent	TTP	NULL	Suricata	T1071.001
HTTP Possible Request Smuggling	TTP	NULL	Suricata	T1071.001
HTTP PUA User Agent	Anomaly	NULL	Suricata	T1071.001
HTTP Rapid POST with Mixed Status Codes	Anomaly	NULL	Nginx Access	T1071.001
HTTP Request to Reserved Name on IIS Server	TTP	NULL	Suricata	T1071.001
HTTP RMM User Agent	Anomaly	NULL	Suricata	T1071.001
HTTP Scripting Tool User Agent	Anomaly	NULL	Nginx Access	T1071.001
HTTP Suspicious Tool User Agent	Anomaly	NULL	Nginx Access	T1071.001
Windows AI Platform DNS Query	Anomaly	NULL	Sysmon EventID 22	T1071.004
Windows App Layer Protocol Qakbot NamedPipe	Anomaly	NULL	Sysmon EventID 17, Sysmon EventID 18	T1071
Windows App Layer Protocol Wermgr Connect To NamedPipe	Anomaly	NULL	Sysmon EventID 17, Sysmon EventID 18	T1071
Windows Application Layer Protocol RMS Radmin Tool Namedpipe	TTP	NULL	Sysmon EventID 17, Sysmon EventID 18	T1071
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script	TTP	NULL	Powershell Script Block Logging 4104	T1071.001
Windows Credential Target Information Structure in Commandline	TTP	NULL	Sysmon EventID 1	T1071.004
Windows DNS Query Request by Telegram Bot API	Anomaly	NULL	Sysmon EventID 22	T1071.004
Windows File Transfer Protocol In Non-Common Process Path	Anomaly	NULL	Sysmon EventID 3	T1071.003
Windows Finger.exe Connecting to a Remote Host	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1071
Windows Kerberos Coercion via DNS	TTP	NULL	Windows Event Log Security 4662, Windows Event Log Security 5136, Windows Event Log Security 5137	T1071.004
Windows Mail Protocol In Non-Common Process Path	Anomaly	NULL	Sysmon EventID 3	T1071.003
Windows Multi hop Proxy TOR Website Query	Anomaly	NULL	Sysmon EventID 22	T1071.003
Windows Non-System Process Querying Definition Update	Anomaly	NULL	Sysmon EventID 22	T1071.001
Windows Powershell Commands from DNS TXT	Anomaly	NULL	Powershell Script Block Logging 4104	T1071.004
Windows Short Lived DNS Record	TTP	NULL	Windows Event Log Security 5136, Windows Event Log Security 5137	T1071.004
Windows Visual Basic Commandline Compiler DNSQuery	TTP	NULL	Sysmon EventID 22	T1071.004

Sub-techniques5

ID	Name	Examples
T1071.001	Web Protocols	422
T1071.002	File Transfer Protocols	27
T1071.003	Mail Protocols	26
T1071.004	DNS	55
T1071.005	Publish/Subscribe Protocols	1

Groups5

Software10

Clambling Duqu Hildegard Lucifer NETEAGLE Nightdoor QUIETEXIT Raspberry Robin Siloscape Sliver

Campaigns1

FrostyGoop Incident

Procedure examples16

Groups5

Used by	Procedure example
GroupINC Ransom	INC Ransom has used valid accounts over RDP to connect to targeted systems. Huntress INC Ransom Group August 2023
GroupMagic Hound	Magic Hound malware has used IRC for C2. DFIR Phosphorus November 2021 Unit 42 Magic Hound Feb 2017
GroupRocke	Rocke issued wget requests from infected systems to the C2. Talos Rocke August 2018
GroupTeamTNT	TeamTNT has used an IRC bot for C2 communications. Trend Micro TeamTNT
GroupVelvet Ant	Velvet Ant has used reverse SSH tunnels to communicate to victim devices. Sygnia VelvetAnt 2024A

Software10

Used by	Procedure example
MalwareClambling	Clambling has the ability to use Telnet for communication. Trend Micro DRBControl February 2020
MalwareDuqu	Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols. Symantec W32.Duqu
MalwareHildegard	Hildegard has used an IRC channel for C2 communications. Unit 42 Hildegard Malware
MalwareLucifer	Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server. Unit 42 Lucifer June 2020
MalwareNETEAGLE	Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.
MalwareNightdoor	Nightdoor uses TCP and UDP communication for command and control traffic. ESET EvasivePanda 2024 Symantec Daggerfly 2024
MalwareQUIETEXIT	QUIETEXIT can use an inverse negotiated SSH connection as part of its C2. Mandiant APT29 Eye Spy Email Nov 22
MalwareRaspberry Robin	Raspberry Robin is capable of contacting the TOR network for delivering second-stage payloads. HP RaspberryRobin 2024 RedCanary RaspberryRobin 2022 TrendMicro RaspberryRobin 2022

View all 10 software examples

Campaigns1

Used by	Procedure example
CampaignFrostyGoop Incident	During FrostyGoop Incident, the adversary initiated Layer Two Tunnelling Protocol (L2TP) connections to Moscow-based IP addresses. Dragos FROSTYGOOP 2024

References1

Mandiant APT29 Eye Spy Email Nov 22 Open source
Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.