MITRE ATT&CKsub-technique

T1437.001 Web Protocols

Published 2022-04-01 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Command And Control
Platforms
Android, iOS
Version
1.0
Created
2022-04-01

Description

Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by blending in with existing traffic. Commands to remote mobile devices, and often the results of those commands, will be embedded within the protocol traffic between the mobile client and server. Web protocols such as HTTP and HTTPS are used for web traffic as well as well as notification services native to mobile messaging services such as Google Cloud Messaging (GCM) and newly, Firebase Cloud Messaging (FCM), (GCM/FCM: two-way communication) and Apple Push Notification Service (APNS; one-way server-to-device). Such notification services leverage HTTP/S via the respective API and are commonly abused on Android and iOS respectively in order blend in with routine device traffic making it difficult for enterprises to inspect.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1437 Application Layer Protocol technique

Tactic · MITRE ATT&CK (1)

  • TA0037 Command and Control tactic

Referenced by MITRE ATT&CK · uses (51)

  • S9040 NGate software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1241 RatMilad software (malware)
  • S1231 GodFather software (malware)
  • S1225 CherryBlos software (malware)
  • S1185 LightSpy software (malware)
  • C0033 C0033 campaign
  • S1195 SpyC23 software (malware)
  • S1094 BRATA software (malware)
  • S1095 AhRat software (malware)
  • S1093 FlyTrap software (malware)
  • S1083 Chameleon software (malware)
  • S1079 BOULDSPY software (malware)
  • S1077 Hornbill software (malware)
  • S1067 FluBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1055 SharkBot software (malware)
  • S0555 CHEMISTGAMES software (malware)
  • S0549 SilkBean software (malware)
  • S0551 GoldenEagle software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0540 Asacub software (malware)
  • S0536 GPlayed software (malware)
  • S0535 Golden Cup software (malware)
  • S0522 Exobot software (malware)
  • S0525 Android/AdDisplay.Ashas software (malware)
  • S0509 FakeSpy software (malware)
  • S0478 EventBot software (malware)
Show all 51 ›

References