Techniques › T1071 › T1071.001
T1071.001 Web Protocols
command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
42
Sigma rules tagged attack.t1071.001
10
KEV CVEs mapped here
<p>Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.</p><p>Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-4577 | PHP Group PHP | secondary impact | Mapped | 2024-06-12 |
| CVE-2024-4978 | Justice AV Solutions Viewer | secondary impact | Mapped | 2024-05-29 |
| CVE-2023-38035 | Ivanti Sentry | secondary impact | Mapped | 2023-08-22 |
| CVE-2023-26360 | Adobe ColdFusion | secondary impact | Mapped | 2023-03-15 |
| CVE-2022-42475 | Fortinet FortiOS | secondary impact | Mapped | 2022-12-13 |
| CVE-2009-4324 | Adobe Acrobat and Reader | primary impact | Mapped | 2022-06-08 |
| CVE-2015-3113 | Adobe Flash Player | primary impact | Mapped | 2022-04-13 |
| CVE-2015-5119 | Adobe Flash Player | secondary impact | Mapped | 2022-03-03 |
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | secondary impact | Mapped | 2021-12-10 |
| CVE-2021-40449 | Microsoft Windows | secondary impact | Mapped | 2021-11-17 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets v1.0
AN0075 WindowsDetects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.Tunable:
ProcessNameExclusionsUserAgentAnomaliesOutboundByteRatioThresholdAN0076 LinuxDetects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.Tunable:CommandLinePatternMatchBeaconIntervalWindowAN0077 macOSDetects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).Tunable:SuspiciousParentProcessURIEntropyThresholdAN0078 ESXiDetects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.Tunable:ShellScriptMatchExternalConnectionFilterAN0079 Network DevicesDetects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.Tunable:HeaderEncodingPatternTLSFingerprintMismatch
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1071.001
Author: citron_ninja
· 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4
Detects a potentially suspicious empty user agent strings in proxy log.
Could potentially indicate an uncommon request method.
Author: Florian Roth (Nextron Systems)
· 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Author: Florian Roth (Nextron Systems)
· 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e
Detects Baby Shark C2 Framework default communication patterns
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801
Detects the installation of VsCode tunnel (code-tunnel) as a service.
Author: frack113
· 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60
Detects execution of curl.exe with custom useragent options
Author: CertainlyP
· 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
Author: Mike Wade
· 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18
Detects wannacry killswitch domain dns queries
Author: Florian Roth (Nextron Systems)
· 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Author: Thomas Patzke
· 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d
Detects suspicious user agent string of APT40 Dropbox tool
Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e
Detects suspicious user agent strings used by malware in proxy logs
Author: Florian Roth (Nextron Systems), Markus Neis
· 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b
Detects suspicious user agent strings used in APT malware in proxy logs
Author: Florian Roth (Nextron Systems)
· 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1
Detects suspicious malformed user agent strings in proxy logs
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.
Author: Florian Roth (Nextron Systems)
· 2020-05-26 (modified 2024-02-26) · logsource: category=proxy · 7857f021-007f-4928-8b2c-7aedbe64bb82
Detects Turla ComRAT network communication.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-22 · logsource: product=zeek service=http · 834c6d2f-5e98-4b2a-b453-0c4f234afedd
Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.
Author: Muhammad Faisal (@faisalusuf)
· 2024-12-19 · logsource: product=windows category=dns_query · 882e858a-3233-4ba8-855e-2f3d3575803d
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Author: Florian Roth (Nextron Systems), Brian Ingram (update)
· 2022-07-08 (modified 2023-05-04) · logsource: category=proxy · 894a8613-cf12-48b3-8e57-9085f54aa0c3
Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
Author: Florian Roth (Nextron Systems)
· 2022-06-10 (modified 2022-08-24) · logsource: category=proxy · 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
Detects Bitsadmin connections to IP addresses instead of FQDN names
Author: Nasreddine Bencherchali (Nextron Systems), citron_ninja
· 2023-10-25 (modified 2025-10-29) · logsource: product=windows category=process_creation · 90d6bd71-dffb-4989-8d86-a827fedd6624
Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Author: Thomas Patzke
· 2019-12-19 (modified 2021-08-09) · logsource: category=proxy · 932ac737-33ca-4afd-9869-0d48b391fcc9
Detects Ursnif C2 traffic.
Author: Florian Roth (Nextron Systems), Tim Shelton
· 2019-03-07 (modified 2023-05-17) · logsource: category=proxy · 9eb68894-7476-4cd6-8752-23b51f5883a7
Detects Bitsadmin connections to domains with uncommon TLDs
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-12-20 · logsource: product=windows category=dns_query · a1d9eec5-33b2-4177-8d24-27fe754d0812
Detects DNS requests to Cloudflared tunnels domains.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Thomas Patzke
· 2019-12-19 (modified 2022-08-15) · logsource: category=proxy · a36ce77e-30db-4ea0-8795-644d7af5dfb4
Detects download of Ursnif malware done by dropper documents.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=dns_query · ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on.
The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz.
The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
Author: citron_ninja
· 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · b3e6418f-7c7a-4fad-993a-93b65027a9f1
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2018-06-05 (modified 2023-05-18) · logsource: category=proxy · b494b165-6634-483d-8c47-2026a6c52372
Detects suspicious requests to Telegram API without the usual Telegram User-Agent
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-15 · logsource: product=linux category=process_creation · b86d356d-6093-443d-971c-9b07db583c68
Detects a suspicious curl process start on linux with set useragent options
Author: Florian Roth (Nextron Systems)
· 2020-07-13 (modified 2024-02-26) · logsource: category=proxy · b923f7d6-ac89-4a50-a71a-89fb846b4aa8
Detects user agent and URI paths used by empire agents
Author: Daniil Yugoslavskiy, oscd.community
· 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Author: Florian Roth (Nextron Systems)
· 2017-03-13 (modified 2021-11-27) · logsource: category=proxy · c8557060-9221-4448-8794-96320e6f3e74
Detects Windows PowerShell Web Access
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-04 · logsource: category=proxy · d443095b-a221-4957-a2c4-cd1756c9b747
Detects suspicious encoded User-Agent strings, as seen used by some malware.
Author: frack113
· 2022-01-23 (modified 2025-07-18) · logsource: product=windows category=ps_script · d4488827-73af-4f8d-9244-7b7662ef046e
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Author: Florian Roth (Nextron Systems)
· 2018-04-06 (modified 2021-11-27) · logsource: category=proxy · e09aed7a-09e0-4c9a-90dd-f0d52507347e
Detects WebDav DownloadCradle
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Author: Arda Buyukkaya (EclecticIQ)
· 2025-02-11 · logsource: product=windows category=process_creation · e99375eb-3ee0-407a-9f90-79569cc6a01c
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.
Author: Markus Neis, Florian Roth (Nextron Systems)
· 2024-02-15 · logsource: category=proxy · f3f21ce1-cdef-4bfc-8328-ed2e826f5fac
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-10-25 · logsource: product=windows category=process_creation · f4a623c2-4ef5-4c33-b811-0642f702c9f1
Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.
Author: Florian Roth (Nextron Systems)
· 2019-10-21 (modified 2021-11-27) · logsource: category=proxy · fa935401-513b-467b-81f4-f9e77aa0dd78
Detects suspicious user agent strings used by crypto miners in proxy logs
Author: Florian Roth (Nextron Systems)
· 2019-01-31 (modified 2024-02-15) · logsource: category=proxy · fb502828-2db0-438e-93e6-801c7548686d
Detects HTTP request used by Chafer malware to receive data from its C2.
Author: Florian Roth (Nextron Systems)
· 2017-07-08 (modified 2025-01-18) · logsource: category=proxy · fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
Rules tagged at the parent level (attack.t1071) 7
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Aleksey Potapov, oscd.community
· 2019-10-22 (modified 2023-02-13) · logsource: product=windows category=process_creation · 03552375-cc2c-4883-bbe4-7958d5a980be
Detects SILENTTRINITY stager use via PE metadata
Author: @kostastsale
· 2024-08-16 · logsource: product=windows category=process_creation · 0ea52357-cd59-4340-9981-c46c7e900428
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.
Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
Author: Tim Burrell
· 2020-02-07 (modified 2023-01-02) · logsource: product=windows service=dns-server-analytic · 3db10f25-2527-4b79-8d4b-471eb900ee29
Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
Author: Tim Burrell
· 2020-02-07 (modified 2024-11-23) · logsource: product=windows category=process_creation · 440a56bf-7873-4439-940a-1c8a671073c2
Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.
Author: Daniel Koifman (KoifSec)
· 2025-11-29 · logsource: product=windows category=process_creation · 5bac7a56-da88-4c27-922e-c81e113b20cb
Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.
Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.
Author: Aleksey Potapov, oscd.community
· 2019-10-22 (modified 2023-02-17) · logsource: product=windows category=image_load · 75c505b1-711d-4f68-a357-8c3fe37dbf2d
Detects SILENTTRINITY stager dll loading activity
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters