Techniques › T1001.003 › AN1294
AN1294 Analytic 1294
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Untrusted processes creating outbound TLS/HTTPS connections with malformed certificates or header fields, often mismatched with target service behavior. Detects protocol impersonation attempts via traffic metadata analysis and host process lineage.</p>
- Detects
- T1001.003 Protocol or Service Impersonation
- Part of
- DET0470 Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| NSM:Flow | SSL/TLS Handshake Analysis | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
IssuerOrgFilter | Organizations in certificate issuer fields to allowlist or monitor. |
UserContext | Restrict detection to non-system users or external-facing applications. |
HeaderSignatureMatch | Specific HTTP header anomalies or patterns (e.g., missing User-Agent). |