{"id":"T1001.003","name":"Protocol or Service Impersonation","url":"https://attack.mitre.org/techniques/T1001/003","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0470","stix_id":"x-mitre-detection-strategy--776a998c-481d-4193-934e-c0af3968c392","name":"Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation","url":"https://attack.mitre.org/detectionstrategies/DET0470","analytics":[{"id":"AN1294","stix_id":"x-mitre-analytic--bcf48294-2388-4ae6-be22-f9038c54e1db","name":"Analytic 1294","description":"Untrusted processes creating outbound TLS/HTTPS connections with malformed certificates or header fields, often mismatched with target service behavior. Detects protocol impersonation attempts via traffic metadata analysis and host process lineage.","url":"https://attack.mitre.org/detectionstrategies/DET0470#AN1294","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"SSL/TLS Handshake Analysis","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"IssuerOrgFilter","description":"Organizations in certificate issuer fields to allowlist or monitor."},{"field":"UserContext","description":"Restrict detection to non-system users or external-facing applications."},{"field":"HeaderSignatureMatch","description":"Specific HTTP header anomalies or patterns (e.g., missing User-Agent)."}],"live":true,"detection_strategies":["DET0470"],"techniques":["T1001.003"]},{"id":"AN1295","stix_id":"x-mitre-analytic--d27a6df2-b2df-443e-8e01-c90243465ceb","name":"Analytic 1295","description":"Detection of binaries spawning encrypted sessions using OpenSSL or curl to external services with mismatched ports/protocols. Identifies behavior where internal services simulate trusted cloud service traffic patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0470#AN1295","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"Network Capture TLS/HTTP","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ProtocolMatchConfidence","description":"Threshold for header-field mismatch against expected service behavior."},{"field":"TimeWindow","description":"Correlation window between process spawn and encrypted session."}],"live":true,"detection_strategies":["DET0470"],"techniques":["T1001.003"]},{"id":"AN1296","stix_id":"x-mitre-analytic--a4119120-396e-4993-8f9d-bc7b5fc94e7e","name":"Analytic 1296","description":"Unsigned or suspicious applications initiating network traffic claiming to be browser, mail, or cloud clients. Detects impersonation via TLS fingerprint and User-Agent string deviation.","url":"https://attack.mitre.org/detectionstrategies/DET0470#AN1296","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Outbound Traffic","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"Process Execution + Hash","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"macos-osquery"},{"name":"NSM:Content","channel":"HTTP Header Metadata","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-content"}],"mutable_elements":[{"field":"ParentProcessFilter","description":"Limit detections to children of suspicious binaries."},{"field":"HeaderAnomalyScore","description":"Threshold for deviation from expected headers (User-Agent, Host)."}],"live":true,"detection_strategies":["DET0470"],"techniques":["T1001.003"]},{"id":"AN1297","stix_id":"x-mitre-analytic--8307d1d4-4f50-481b-9126-3b145fd68a73","name":"Analytic 1297","description":"ESXi hosts initiating connections from non-standard daemons mimicking HTTP/HTTPS or SNMP traffic, but with irregular payload formats or expired/unsigned TLS certificates.","url":"https://attack.mitre.org/detectionstrategies/DET0470#AN1297","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"Service-Based Network Connection","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"esxi-hostd"},{"name":"NSM:Content","channel":"TLS Fingerprint and Certificate Analysis","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-content"}],"mutable_elements":[{"field":"TLSFingerprintMatch","description":"Allows matching against known-good or known-bad JA3/JA3S hashes."},{"field":"AllowedServicePorts","description":"Tune for expected network ports per ESXi role."}],"live":true,"detection_strategies":["DET0470"],"techniques":["T1001.003"]}],"live":true,"version":"1.0","techniques":["T1001.003"]}],"sigma_rules":[{"id":"75bf09fa-1dd7-4d18-9af9-dd9e492562eb","title":"ADSI-Cache File Creation By Uncommon Tool","author":"xknow @xknow_infosec, Tim Shelton","status":"test","level":"medium","date":"2019-03-24","modified":"2023-10-18","description":"Detects the creation of an \"Active Directory Schema Cache File\" (.sch) file by an uncommon tool.","references":["https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961","https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/","https://github.com/fox-it/LDAPFragger"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.t1001.003","attack.command-and-control"],"path":"rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml","techniques":["T1001.003"],"cves":[]},{"id":"d00a9a72-2c09-4459-ad03-5e0a23351e36","title":"Suspicious LDAP-Attributes Used","author":"xknow @xknow_infosec","status":"test","level":"high","date":"2019-03-24","modified":"2022-10-05","description":"Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.","references":["https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961","https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/","https://github.com/fox-it/LDAPFragger"],"logsource":{"product":"windows","service":"security"},"tags":["attack.t1001.003","attack.command-and-control"],"path":"rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml","techniques":["T1001.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}