MITRE ATT&CKsub-technique

T1071.003 Mail Protocols

Published 2020-03-15 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
Linux, macOS, Network Devices, Windows
Version
1.2
Created
2020-03-15

Description

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1071 Application Layer Protocol technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1037 Filter Network Traffic mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (26)

  • G1052 Contagious Interview group
  • S1173 PowerExchange software (malware)
  • S1152 IMAPLoader software (malware)
  • S1142 LunarMail software (malware)
  • S1090 NightClub software (malware)
  • S1042 SUGARDUMP software (malware)
  • S0495 RDAT software (malware)
  • S0477 Goopy software (malware)
  • G0094 Kimsuky group
  • S0395 LightNeuron software (malware)
  • S0351 Cannon software (malware)
  • G0083 SilverTerrier group
  • S0331 Agent Tesla software (malware)
  • S0337 BadPatch software (malware)
  • S0247 NavRAT software (malware)
  • S0251 Zebrocy software (malware)
  • S0201 JPIN software (malware)
  • G0050 APT32 group
  • G0007 APT28 group
  • G0010 Turla group
  • S0022 Uroburos software (malware)
  • S0023 CHOPSTICK software (malware)
  • S0125 Remsec software (malware)
  • S0126 ComRAT software (malware)
  • S0137 CORESHELL software (malware)
  • S0138 OLDBAIT software (malware)

Referenced by Compliance · mitigates (19)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) NIST 800-53 control
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References