{"id":"T1071.001","name":"Web Protocols","url":"https://attack.mitre.org/techniques/T1071/001","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0027","stix_id":"x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc","name":"Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets","url":"https://attack.mitre.org/detectionstrategies/DET0027","analytics":[{"id":"AN0075","stix_id":"x-mitre-analytic--04fe83c3-d8d3-4c96-91a4-9167fa8f405a","name":"Analytic 0075","description":"Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0027#AN0075","platforms":["Windows"],"log_source_references":[{"name":"NSM:Flow","channel":"http.log, ssl.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ProcessNameExclusions","description":"Filter out legitimate browser/network utilities"},{"field":"UserAgentAnomalies","description":"Detect non-browser user-agents or spoofed headers"},{"field":"OutboundByteRatioThreshold","description":"Flag when outbound > inbound volume by 90%+"}],"live":true,"detection_strategies":["DET0027"],"techniques":["T1071.001"]},{"id":"AN0076","stix_id":"x-mitre-analytic--cba23232-7fae-47df-bd83-0ca5a5066373","name":"Analytic 0076","description":"Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.","url":"https://attack.mitre.org/detectionstrategies/DET0027#AN0076","platforms":["Linux"],"log_source_references":[{"name":"NSM:Flow","channel":"http.log, conn.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"CommandLinePatternMatch","description":"curl or wget in scripts with suspicious domains or silent flags"},{"field":"BeaconIntervalWindow","description":"Fixed-timed HTTP callbacks with 60±5s jitter"}],"live":true,"detection_strategies":["DET0027"],"techniques":["T1071.001"]},{"id":"AN0077","stix_id":"x-mitre-analytic--5ff3ae40-d326-4eae-9bc5-c77ddcb6cb6e","name":"Analytic 0077","description":"Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).","url":"https://attack.mitre.org/detectionstrategies/DET0027#AN0077","platforms":["macOS"],"log_source_references":[{"name":"macos:osquery","channel":"socket_events","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"macos-osquery"},{"name":"macos:unifiedlog","channel":"log stream --predicate","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"SuspiciousParentProcess","description":"Non-browser parent of web traffic (e.g., AppleScript, bash)"},{"field":"URIEntropyThreshold","description":"Unusually encoded data in GET/POST URIs"}],"live":true,"detection_strategies":["DET0027"],"techniques":["T1071.001"]},{"id":"AN0078","stix_id":"x-mitre-analytic--38205f16-18da-4d04-ae54-f5143b75c938","name":"Analytic 0078","description":"Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.","url":"https://attack.mitre.org/detectionstrategies/DET0027#AN0078","platforms":["ESXi"],"log_source_references":[{"name":"NSM:Flow","channel":"SPAN or port-mirrored HTTP/S","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"esxi:shell","channel":"/root/.ash_history or /etc/init.d/*","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"ShellScriptMatch","description":"Match on commands like `wget https://*`, `curl -s`"},{"field":"ExternalConnectionFilter","description":"Public IPs or external DNS hostnames"}],"live":true,"detection_strategies":["DET0027"],"techniques":["T1071.001"]},{"id":"AN0079","stix_id":"x-mitre-analytic--1f1ed319-a6f9-4f30-9254-e0b1927a6bd9","name":"Analytic 0079","description":"Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.","url":"https://attack.mitre.org/detectionstrategies/DET0027#AN0079","platforms":["Network Devices"],"log_source_references":[{"name":"NSM:Flow","channel":"http.log, ssl.log, websocket.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"HeaderEncodingPattern","description":"Base64, hex, or UTF-16 encoding in URI, cookie, or host"},{"field":"TLSFingerprintMismatch","description":"JA3 hash deviation from known clients"}],"live":true,"detection_strategies":["DET0027"],"techniques":["T1071.001"]}],"live":true,"version":"1.0","techniques":["T1071.001"]}],"sigma_rules":[{"id":"1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b","title":"DNS Query To Devtunnels Domain","author":"citron_ninja","status":"test","level":"medium","date":"2023-10-25","modified":"2023-11-20","description":"Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.\n","references":["https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","https://cydefops.com/devtunnels-unleashed"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1572"],"path":"rules/windows/dns_query/dns_query_win_devtunnels_communication.yml","techniques":["T1071.001","T1572"],"cves":[]},{"id":"21e44d78-95e7-421b-a464-ffd8395659c4","title":"HTTP Request With Empty User Agent","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-07-08","modified":"2021-11-27","description":"Detects a potentially suspicious empty user agent strings in proxy log.\nCould potentially indicate an uncommon request method.\n","references":["https://twitter.com/Carlos_Perez/status/883455096645931008"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_empty.yml","techniques":["T1071.001"],"cves":[]},{"id":"2b1ee7e4-89b6-4739-b7bb-b811b6607e5e","title":"PwnDrp Access","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-04-15","modified":"2021-11-27","description":"Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity","references":["https://breakdev.org/pwndrop/"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1102.001","attack.t1102.003"],"path":"rules/web/proxy_generic/proxy_pwndrop.yml","techniques":["T1071.001","T1102.001","T1102.003"],"cves":[]},{"id":"2cf29f11-e356-4f61-98c0-1bdb9393d6da","title":"Renamed Visual Studio Code Tunnel Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-09-28","modified":"2025-10-29","description":"Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel","references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://code.visualstudio.com/docs/remote/tunnels"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1219"],"path":"rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml","techniques":["T1071.001","T1219"],"cves":[]},{"id":"304810ed-8853-437f-9e36-c4975c3dfd7e","title":"HackTool - BabyShark Agent Default URL Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-06-09","modified":"2024-02-15","description":"Detects Baby Shark C2 Framework default communication patterns","references":["https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml","techniques":["T1071.001"],"cves":[]},{"id":"30bf1789-379d-4fdc-900f-55cd0a90a801","title":"Visual Studio Code Tunnel Service Installation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-10-25","modified":null,"description":"Detects the installation of VsCode tunnel (code-tunnel) as a service.","references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://code.visualstudio.com/docs/remote/tunnels"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml","techniques":["T1071.001"],"cves":[]},{"id":"3286d37a-00fd-41c2-a624-a672dcd34e60","title":"Curl.EXE Execution With Custom UserAgent","author":"frack113","status":"test","level":"medium","date":"2022-01-23","modified":"2023-02-21","description":"Detects execution of curl.exe with custom useragent options","references":["https://curl.se/docs/manpage.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#atomic-test-2---malicious-user-agents---cmd"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_curl_useragent.yml","techniques":["T1071.001"],"cves":[]},{"id":"37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1","title":"Outbound Network Connection Initiated By Microsoft Dialer","author":"CertainlyP","status":"test","level":"high","date":"2024-04-26","modified":null,"description":"Detects outbound network connection initiated by Microsoft Dialer.\nThe Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.\nThis is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is \"Rhadamanthys\"\n","references":["https://tria.ge/240301-rk34sagf5x/behavioral2","https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d","https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/","https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.execution","attack.command-and-control","attack.t1071.001"],"path":"rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml","techniques":["T1071.001"],"cves":[]},{"id":"3eaf6218-3bed-4d8a-8707-274096f12a18","title":"Wannacry Killswitch Domain","author":"Mike Wade","status":"test","level":"high","date":"2020-09-16","modified":"2022-03-24","description":"Detects wannacry killswitch domain dns queries","references":["https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign"],"logsource":{"category":"dns"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/network/dns/net_dns_wannacry_killswitch_domain.yml","techniques":["T1071.001"],"cves":[]},{"id":"5468045b-4fcc-4d1a-973c-c9c9578edacb","title":"Raw Paste Service Access","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-12-05","modified":"2023-01-19","description":"Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form","references":["https://www.virustotal.com/gui/domain/paste.ee/relations"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1102.001","attack.t1102.003"],"path":"rules/web/proxy_generic/proxy_raw_paste_service_access.yml","techniques":["T1071.001","T1102.001","T1102.003"],"cves":[]},{"id":"5ba715b6-71b7-44fd-8245-f66893e81b3d","title":"APT40 Dropbox Tool User Agent","author":"Thomas Patzke","status":"test","level":"high","date":"2019-11-12","modified":"2023-05-18","description":"Detects suspicious user agent string of APT40 Dropbox tool","references":["Internal research from Florian Roth"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001","attack.exfiltration","attack.t1567.002","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/APT40/proxy_apt_apt40_dropbox_tool_ua.yml","techniques":["T1071.001","T1567.002"],"cves":[]},{"id":"5c84856b-55a5-45f1-826f-13f37250cf4e","title":"Malware User Agent","author":"Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2017-07-08","modified":"2024-04-14","description":"Detects suspicious user agent strings used by malware in proxy logs","references":["http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules","http://www.botopedia.org/search?searchword=scan&searchphrase=all","https://networkraptor.blogspot.com/2015/01/user-agent-strings.html","https://perishablepress.com/blacklist/ua-2013.txt","https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents","https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q","https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large","https://twitter.com/crep1x/status/1635034100213112833"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_malware.yml","techniques":["T1071.001"],"cves":[]},{"id":"6ec820f2-e963-4801-9127-d8b2dce4d31b","title":"APT User Agent","author":"Florian Roth (Nextron Systems), Markus Neis","status":"test","level":"high","date":"2019-11-12","modified":"2024-02-15","description":"Detects suspicious user agent strings used in APT malware in proxy logs","references":["Internal Research"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_apt.yml","techniques":["T1071.001"],"cves":[]},{"id":"7195a772-4b3f-43a4-a210-6a003d65caa1","title":"Suspicious User Agent","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-07-08","modified":"2022-10-31","description":"Detects suspicious malformed user agent strings in proxy logs","references":["https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_susp.yml","techniques":["T1071.001"],"cves":[]},{"id":"73e5d24f-493f-4092-bd2f-c72cabda40ee","title":"Axios NPM Compromise Malicious C2 Domain DNS Query","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-01","modified":null,"description":"Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise.\nOn March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.\nThis detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.\n","references":["https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan","https://www.derp.ca/research/axios-npm-supply-chain-rat/","https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html","https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections","https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09","https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package"],"logsource":{"category":"dns"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1568","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/net_dns_axios_npm_compromise_indicator.yml","techniques":["T1071.001","T1568"],"cves":[]},{"id":"7857f021-007f-4928-8b2c-7aedbe64bb82","title":"ComRAT Network Communication","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-05-26","modified":"2024-02-26","description":"Detects Turla ComRAT network communication.","references":["https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001","attack.g0010","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/ComRAT/proxy_malware_comrat_network_indicators.yml","techniques":["T1071.001"],"cves":[]},{"id":"834c6d2f-5e98-4b2a-b453-0c4f234afedd","title":"Katz Stealer Suspicious User-Agent","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-05-22","modified":null,"description":"Detects network connections with a suspicious user-agent string containing \"katz-ontop\", which may indicate Katz Stealer activity.\n","references":["Internal Research"],"logsource":{"product":"zeek","service":"http"},"tags":["attack.command-and-control","attack.t1071.001","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Katz-Stealer/zeek_http_katz_stealer_susp_useragent.yml","techniques":["T1071.001"],"cves":[]},{"id":"882e858a-3233-4ba8-855e-2f3d3575803d","title":"DNS Query Request By QuickAssist.EXE","author":"Muhammad Faisal (@faisalusuf)","status":"experimental","level":"low","date":"2024-12-19","modified":null,"description":"Detects DNS queries initiated by \"QuickAssist.exe\" to Microsoft Quick Assist primary endpoint that is used to establish a session.\n","references":["https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/","https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/","https://x.com/cyb3rops/status/1862406110365245506","https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.command-and-control","attack.initial-access","attack.lateral-movement","attack.t1071.001","attack.t1210"],"path":"rules/windows/dns_query/dns_query_win_quickassist.yml","techniques":["T1071.001","T1210"],"cves":[]},{"id":"894a8613-cf12-48b3-8e57-9085f54aa0c3","title":"Potential Base64 Encoded User-Agent","author":"Florian Roth (Nextron Systems), Brian Ingram (update)","status":"test","level":"medium","date":"2022-07-08","modified":"2023-05-04","description":"Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.","references":["https://blogs.jpcert.or.jp/en/2022/07/yamabot.html","https://deviceatlas.com/blog/list-of-user-agent-strings#desktop"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_susp_base64.yml","techniques":["T1071.001"],"cves":[]},{"id":"8ccd35a2-1c7c-468b-b568-ac6cdf80eec3","title":"Bitsadmin to Uncommon IP Server Address","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-10","modified":"2022-08-24","description":"Detects Bitsadmin connections to IP addresses instead of FQDN names","references":["https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1071.001","attack.persistence","attack.t1197","attack.s0190"],"path":"rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml","techniques":["T1071.001","T1197"],"cves":[]},{"id":"90d6bd71-dffb-4989-8d86-a827fedd6624","title":"Visual Studio Code Tunnel Execution","author":"Nasreddine Bencherchali (Nextron Systems), citron_ninja","status":"test","level":"medium","date":"2023-10-25","modified":"2025-10-29","description":"Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel","references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://code.visualstudio.com/docs/remote/tunnels"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1219"],"path":"rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml","techniques":["T1071.001","T1219"],"cves":[]},{"id":"932ac737-33ca-4afd-9869-0d48b391fcc9","title":"Ursnif Malware C2 URL Pattern","author":"Thomas Patzke","status":"stable","level":"critical","date":"2019-12-19","modified":"2021-08-09","description":"Detects Ursnif C2 traffic.","references":["https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document.html"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.t1566.001","attack.execution","attack.t1204.002","attack.command-and-control","attack.t1071.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_c2_url.yml","techniques":["T1566.001","T1204.002","T1071.001"],"cves":[]},{"id":"9eb68894-7476-4cd6-8752-23b51f5883a7","title":"Bitsadmin to Uncommon TLD","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2019-03-07","modified":"2023-05-17","description":"Detects Bitsadmin connections to domains with uncommon TLDs","references":["https://twitter.com/jhencinski/status/1102695118455349248","https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1071.001","attack.persistence","attack.t1197","attack.s0190"],"path":"rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml","techniques":["T1071.001","T1197"],"cves":[]},{"id":"a1d9eec5-33b2-4177-8d24-27fe754d0812","title":"Cloudflared Tunnels Related DNS Requests","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-12-20","modified":null,"description":"Detects DNS requests to Cloudflared tunnels domains.\nAttackers can abuse that feature to establish a reverse shell or persistence on a machine.\n","references":["https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/","Internal Research"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1572"],"path":"rules/windows/dns_query/dns_query_win_cloudflared_communication.yml","techniques":["T1071.001","T1572"],"cves":[]},{"id":"a36ce77e-30db-4ea0-8795-644d7af5dfb4","title":"Ursnif Malware Download URL Pattern","author":"Thomas Patzke","status":"stable","level":"high","date":"2019-12-19","modified":"2022-08-15","description":"Detects download of Ursnif malware done by dropper documents.","references":["https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_download_url.yml","techniques":["T1071.001"],"cves":[]},{"id":"ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c","title":"TanStack Supply-Chain Attack DNS Indicators","author":"Leonardo Gasparini","status":"experimental","level":"medium","date":"2026-05-12","modified":null,"description":"Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on.\nThe domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz.\nThe filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.\n","references":["https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.command-and-control","attack.t1071.001","attack.exfiltration","attack.t1048","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/dns_query_win_malware_tanstack_supply_chain_c2.yml","techniques":["T1071.001","T1048"],"cves":[]},{"id":"b3e6418f-7c7a-4fad-993a-93b65027a9f1","title":"DNS Query To Visual Studio Code Tunnels Domain","author":"citron_ninja","status":"test","level":"medium","date":"2023-10-25","modified":"2023-11-20","description":"Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.\n","references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://cydefops.com/vscode-data-exfiltration"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml","techniques":["T1071.001"],"cves":[]},{"id":"b494b165-6634-483d-8c47-2026a6c52372","title":"Telegram API Access","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-06-05","modified":"2023-05-18","description":"Detects suspicious requests to Telegram API without the usual Telegram User-Agent","references":["https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/","https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/","https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001","attack.t1102.002"],"path":"rules/web/proxy_generic/proxy_telegram_api.yml","techniques":["T1071.001","T1102.002"],"cves":[]},{"id":"b86d356d-6093-443d-971c-9b07db583c68","title":"Suspicious Curl Change User Agents - Linux","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-15","modified":null,"description":"Detects a suspicious curl process start on linux with set useragent options","references":["https://curl.se/docs/manpage.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml","techniques":["T1071.001"],"cves":[]},{"id":"b923f7d6-ac89-4a50-a71a-89fb846b4aa8","title":"HackTool - Empire UserAgent URI Combo","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-07-13","modified":"2024-02-26","description":"Detects user agent and URI paths used by empire agents","references":["https://github.com/BC-SECURITY/Empire"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml","techniques":["T1071.001"],"cves":[]},{"id":"c75309a3-59f8-4a8d-9c2c-4c927ad50555","title":"Tunneling Tool Execution","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2019-10-24","modified":"2024-01-18","description":"Detects the execution of well known tools that can be abused for data exfiltration and tunneling.","references":["https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.exfiltration","attack.command-and-control","attack.t1041","attack.t1572","attack.t1071.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_exfil_and_tunneling_tool_execution.yml","techniques":["T1041","T1572","T1071.001"],"cves":[]},{"id":"c8557060-9221-4448-8794-96320e6f3e74","title":"Windows PowerShell User Agent","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-03-13","modified":"2021-11-27","description":"Detects Windows PowerShell Web Access","references":["https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_powershell.yml","techniques":["T1071.001"],"cves":[]},{"id":"d443095b-a221-4957-a2c4-cd1756c9b747","title":"Suspicious Base64 Encoded User-Agent","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-04","modified":null,"description":"Detects suspicious encoded User-Agent strings, as seen used by some malware.","references":["https://deviceatlas.com/blog/list-of-user-agent-strings#desktop"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_base64_encoded.yml","techniques":["T1071.001"],"cves":[]},{"id":"d4488827-73af-4f8d-9244-7b7662ef046e","title":"Change User Agents with WebRequest","author":"frack113","status":"test","level":"medium","date":"2022-01-23","modified":"2025-07-18","description":"Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.\nCommands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml","techniques":["T1071.001"],"cves":[]},{"id":"e09aed7a-09e0-4c9a-90dd-f0d52507347e","title":"Windows WebDAV User Agent","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2018-04-06","modified":"2021-11-27","description":"Detects WebDav DownloadCradle","references":["https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_downloadcradle_webdav.yml","techniques":["T1071.001"],"cves":[]},{"id":"e0cfaecd-602d-41af-988d-f6ccebb2af26","title":"Suspicious Installer Package Child Process","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-02-18","modified":null,"description":"Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters","references":["https://redcanary.com/blog/clipping-silver-sparrows-wings/","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.t1059","attack.t1059.007","attack.t1071","attack.t1071.001","attack.execution","attack.command-and-control"],"path":"rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml","techniques":["T1059","T1059.007","T1071","T1071.001"],"cves":[]},{"id":"e99375eb-3ee0-407a-9f90-79569cc6a01c","title":"Kalambur Backdoor Curl TOR SOCKS Proxy Execution","author":"Arda Buyukkaya (EclecticIQ)","status":"experimental","level":"high","date":"2025-02-11","modified":null,"description":"Detects the execution of the \"curl.exe\" command, referencing \"SOCKS\" and \".onion\" domains, which could be indicative of Kalambur backdoor activity.","references":["https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.command-and-control","attack.t1090","attack.t1573","attack.t1071.001","attack.t1059.001","attack.s0183","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/proc_creation_win_malware_kalambur_curl_socks_tor.yml","techniques":["T1090","T1573","T1071.001","T1059.001"],"cves":[]},{"id":"f3f21ce1-cdef-4bfc-8328-ed2e826f5fac","title":"HackTool - CobaltStrike Malleable Profile Patterns - Proxy","author":"Markus Neis, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2024-02-15","modified":null,"description":"Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).","references":["https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile","https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100","https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile","https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/","https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml","techniques":["T1071.001"],"cves":[]},{"id":"f4a623c2-4ef5-4c33-b811-0642f702c9f1","title":"Visual Studio Code Tunnel Shell Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-10-25","modified":null,"description":"Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.","references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://code.visualstudio.com/docs/remote/tunnels"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml","techniques":["T1071.001"],"cves":[]},{"id":"fa935401-513b-467b-81f4-f9e77aa0dd78","title":"Crypto Miner User Agent","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-10-21","modified":"2021-11-27","description":"Detects suspicious user agent strings used by crypto miners in proxy logs","references":["https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65","https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_cryptominer.yml","techniques":["T1071.001"],"cves":[]},{"id":"fb502828-2db0-438e-93e6-801c7548686d","title":"Chafer Malware URL Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-01-31","modified":"2024-02-15","description":"Detects HTTP request used by Chafer malware to receive data from its C2.","references":["https://securelist.com/chafer-used-remexi-malware/89538/"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Chafer/proxy_malware_chafer_url_pattern.yml","techniques":["T1071.001"],"cves":[]},{"id":"fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f","title":"Exploit Framework User Agent","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-07-08","modified":"2025-01-18","description":"Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs","references":["https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.t1071.001"],"path":"rules/web/proxy_generic/proxy_ua_frameworks.yml","techniques":["T1071.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-4577","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-4978","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-38035","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-26360","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-42475","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2009-4324","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2015-3113","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2015-5119","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-35394","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40449","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}