Techniques › T1071 › T1071.005
T1071.005 Publish/Subscribe Protocols
command and control — macOS, Linux, Windows, Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1071.005
0
KEV CVEs mapped here
<p>Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.</p><p>Protocols such as <code>MQTT</code>, <code>XMPP</code>, <code>AMQP</code>, and <code>STOMP</code> use a publish/subscribe design, with message distribution managed by a centralized broker. Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics. An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also mimicking normal, expected traffic.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0002 Behavioral Detection of Publish/Subscribe Protocol Misuse for C2 v1.0
AN0002 WindowsDetects non-standard processes (e.g., PowerShell, python.exe, rundll32.exe) making outbound connections using publish/subscribe protocols (e.g., MQTT, AMQP) over non-browser, encrypted channels, often beaconing to message brokers.Tunable:
UnusualProcessListTimeWindowProtocolPortListAN0003 LinuxDetects CLI tools (e.g., mosquitto_pub, nc, python scripts) interacting with pub/sub brokers using unusual topic names, high-frequency publication rates, or obfuscated payloads to non-standard hosts.Tunable:BrokerAllowListTopicAnomalyScoreAN0004 macOSDetects osascript, curl, or custom binaries interacting with XMPP/MQTT brokers in unapproved destinations with encrypted payloads or frequent POST-like requests to broker URIs.Tunable:AppContextFilterURIPathRegexAN0005 Network DevicesDetects pub/sub traffic over unusual ports, high-frequency topic publications, and connections to known-bad or dynamic broker endpoints outside allowlisted infrastructure.Tunable:BrokerReputationListPayloadLengthThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1071.005
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1071) 7
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Aleksey Potapov, oscd.community
· 2019-10-22 (modified 2023-02-13) · logsource: product=windows category=process_creation · 03552375-cc2c-4883-bbe4-7958d5a980be
Detects SILENTTRINITY stager use via PE metadata
Author: @kostastsale
· 2024-08-16 · logsource: product=windows category=process_creation · 0ea52357-cd59-4340-9981-c46c7e900428
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.
Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
Author: Tim Burrell
· 2020-02-07 (modified 2023-01-02) · logsource: product=windows service=dns-server-analytic · 3db10f25-2527-4b79-8d4b-471eb900ee29
Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
Author: Tim Burrell
· 2020-02-07 (modified 2024-11-23) · logsource: product=windows category=process_creation · 440a56bf-7873-4439-940a-1c8a671073c2
Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.
Author: Daniel Koifman (KoifSec)
· 2025-11-29 · logsource: product=windows category=process_creation · 5bac7a56-da88-4c27-922e-c81e113b20cb
Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.
Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.
Author: Aleksey Potapov, oscd.community
· 2019-10-22 (modified 2023-02-17) · logsource: product=windows category=image_load · 75c505b1-711d-4f68-a357-8c3fe37dbf2d
Detects SILENTTRINITY stager dll loading activity
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters