MITRE ATT&CKtechnique

T1071 Application Layer Protocol

Published 2017-05-31 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
Linux, macOS, Windows, Network Devices, ESXi
Version
2.4
Created
2017-05-31

Description

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1037 Filter Network Traffic mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · subtechnique of (5)

Referenced by MITRE ATT&CK · uses (17)

  • G1059 NIMBUS MANTICORE group
  • G1047 Velvet Ant group
  • C0041 FrostyGoop Incident campaign
  • S1147 Nightdoor software (malware)
  • G1032 INC Ransom group
  • S1130 Raspberry Robin software (malware)
  • S1084 QUIETEXIT software (malware)
  • S0660 Clambling software (malware)
  • G0139 TeamTNT group
  • S0633 Sliver software (tool)
  • S0623 Siloscape software (malware)
  • S0601 Hildegard software (malware)
  • S0532 Lucifer software (malware)
  • G0106 Rocke group
  • G0059 Magic Hound group
  • S0034 NETEAGLE software (malware)
  • S0038 Duqu software (malware)

Referenced by Compliance · mitigates (22)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) NIST 800-53 control
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References