MITRE ATT&CKtechnique

T1095 Non-Application Layer Protocol

Published 2017-05-31 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
2.4
Created
2017-05-31

Description

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL). ICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts. However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications. In ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host’s backdoor, regardless of network segmentation or firewall rules in place.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1037 Filter Network Traffic mitigation
  • M1047 Audit mitigation
  • M1030 Network Segmentation mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (109)

  • S9023 HiddenFace software (malware)
  • S9001 SystemBC software (malware)
  • S1245 InvisibleFerret software (malware)
  • S1239 TONESHELL software (malware)
  • S1227 StarProxy software (malware)
  • C0056 RedPenguin campaign
  • S1221 MOPSLED software (malware)
  • S1219 REPTILE software (malware)
  • G1048 UNC3886 group
  • G1045 Salt Typhoon group
  • S1204 cd00r software (malware)
  • S1203 J-magic software (malware)
  • S1200 StealBit software (malware)
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • S1187 reGeorg software (malware)
  • S1189 Neo-reGeorg software (malware)
  • S1163 SnappyTCP software (malware)
  • C0039 Versa Director Zero Day Exploitation campaign
  • S1153 Cuckoo Stealer software (malware)
  • S1144 FRP software (tool)
  • S1142 LunarMail software (malware)
  • S1140 Spica software (malware)
  • C0035 KV Botnet Activity campaign
  • C0034 2022 Ukraine Electric Power Attack campaign
  • S1121 LITTLELAMB.WOOLTEA software (malware)
  • C0029 Cutting Edge campaign
  • S1114 ZIPLINE software (malware)
  • S1105 COATHANGER software (malware)
  • S1100 Ninja software (malware)
  • S1099 Samurai software (malware)
Show all 109 ›

Referenced by Compliance · mitigates (18)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-15 Information Output Filtering NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References