MITRE ATT&CKtechnique

T1437 Application Layer Protocol

Published 2017-10-25 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Command And Control
Platforms
Android, iOS
Version
1.2
Created
2017-10-25

Description

Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the mobile device, and often the results of those commands, will be embedded within the protocol traffic between the mobile device and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.

Related

Tactic · MITRE ATT&CK (1)

  • TA0037 Command and Control tactic

Referenced by MITRE ATT&CK · subtechnique of (1)

Referenced by MITRE ATT&CK · uses (6)

  • S9040 NGate software (malware)
  • S1243 DCHSpy software (malware)
  • C0054 Operation Triangulation campaign
  • S1083 Chameleon software (malware)
  • S1054 Drinik software (malware)
  • S0550 DoubleAgent software (malware)

References