MITRE ATT&CKtechnique

T0869 Standard Application Layer Protocol

Published 2020-05-21 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Command And Control
Platforms
Embedded, Windows, Linux, Network Devices
Version
1.0
Created
2020-05-21

Description

Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus. These protocols may be used to disguise adversary actions as benign network traffic. Standard protocols may be seen on their associated port or in some cases over a non-standard port. Adversaries may use these protocols to reach out of the network for command and control, or in some cases to other infected devices within the network.

Related

Tactic · MITRE ATT&CK (1)

  • TA0101 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M0807 Network Allowlists mitigation
  • M0930 Network Segmentation mitigation
  • M0931 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · subtechnique of (2)

Referenced by MITRE ATT&CK · uses (7)

  • S1165 FrostyGoop software (malware)
  • S1045 INCONTROLLER software (malware)
  • S0603 Stuxnet software (malware)
  • S0496 REvil software (malware)
  • S1009 Triton software (malware)
  • G0049 OilRig group
  • S0089 BlackEnergy software (malware)