MITRE ATT&CKsub-technique

T1001.003 Protocol or Service Impersonation

Published 2020-03-15 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
2.1
Created
2020-03-15

Description

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1001 Data Obfuscation technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (23)

  • S9061 LIGHTRAIL software (malware)
  • S1239 TONESHELL software (malware)
  • S1228 PUBLOAD software (malware)
  • S1226 BOOKWORM software (malware)
  • S1227 StarProxy software (malware)
  • S1120 FRAMESTING software (malware)
  • S1100 Ninja software (malware)
  • C0017 C0017 campaign
  • G0129 Mustang Panda group
  • G0126 Higaisa group
  • S0586 TAINTEDSCRIBE software (malware)
  • S0559 SUNBURST software (malware)
  • S0439 Okrum software (malware)
  • S0387 KeyBoy software (malware)
  • S0239 Bankshot software (malware)
  • S0245 BADCALL software (malware)
  • S0246 HARDRAIN software (malware)
  • S0260 InvisiMole software (malware)
  • S0181 FALLCHILL software (malware)
  • S0154 Cobalt Strike software (malware)
  • G0032 Lazarus Group group
  • S0022 Uroburos software (malware)
  • S0076 FakeM software (malware)

Referenced by Compliance · mitigates (8)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References