MITRE ATT&CKsub-technique

T1071.001 Web Protocols

Published 2020-03-15 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.5
Created
2020-03-15

Description

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1071 Application Layer Protocol technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1037 Filter Network Traffic mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (431)

  • S9062 MiniBrowse software (malware)
  • S9066 POLLBLEND software (malware)
  • S9061 LIGHTRAIL software (malware)
  • S9059 MiniBike software (malware)
  • S9060 MiniBus software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • S9050 Vidar software (malware)
  • S9044 Kali365 software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9035 LAMEHUG software (malware)
  • S9037 RustyWater software (malware)
  • G1055 VOID MANTICORE group
  • S9029 IronWind software (malware)
  • S9031 AshTag software (malware)
  • S9032 MuddyViper software (malware)
  • S9034 Tsundere Botnet software (malware)
  • S9028 PHPsert software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9010 GlassWorm software (malware)
  • S9008 Shai-Hulud software (malware)
  • S9007 HTTPTroy software (malware)
  • S9003 evilginx2 software (tool)
  • S1248 XORIndex Loader software (malware)
  • S1249 HexEval Loader software (malware)
  • S1246 BeaverTail software (malware)
  • S1245 InvisibleFerret software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
Show all 431 ›

Referenced by Compliance · mitigates (22)

  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) NIST 800-53 control
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References