MITRE ATT&CKsub-technique

T1071.002 File Transfer Protocols

Published 2020-03-15 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.4
Created
2020-03-15

Description

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMB, FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1071 Application Layer Protocol technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1037 Filter Network Traffic mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (28)

  • G1054 MirrorFace group
  • S1242 Qilin software (malware)
  • S1229 Havoc software (malware)
  • S1228 PUBLOAD software (malware)
  • C0055 Quad7 Activity campaign
  • G1045 Salt Typhoon group
  • S1089 SharpDisco software (malware)
  • S1088 Disco software (malware)
  • S1081 BADHATCH software (malware)
  • C0006 Operation Honeybee campaign
  • S0699 Mythic software (tool)
  • S0596 ShadowPad software (malware)
  • S0464 SYSCON software (malware)
  • S0465 CARROTBALL software (tool)
  • S0438 Attor software (malware)
  • S0428 PoetRAT software (malware)
  • S0412 ZxShell software (malware)
  • G0096 APT41 group
  • S0409 Machete software (malware)
  • G0094 Kimsuky group
  • S0353 NOKKI software (malware)
  • G0083 SilverTerrier group
  • S0265 Kazuar software (malware)
  • S0201 JPIN software (malware)
  • S0154 Cobalt Strike software (malware)
  • S0161 XAgentOSX software (malware)
  • G0035 Dragonfly group
  • S0019 Regin software (malware)

Referenced by Compliance · mitigates (19)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) NIST 800-53 control
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References