kevmap

Techniques › T1095

T1095 Non-Application Layer Protocol

command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
5
analytics
3
Sigma rules tagged attack.t1095
0
KEV CVEs mapped here
<p>Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).</p><p>ICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts. However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.</p><p>In ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host’s backdoor, regardless of network segmentation or firewall rules in place.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1095

Netcat The Powershell Version mediumtest
Author: frack113 · 2021-07-21 (modified 2023-10-27) · logsource: product=windows category=ps_classic_start · c5b20776-639a-49bf-94c7-84f912b91c15
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Techniques: T1095T1059.001
PUA - Netcat Suspicious Execution hightest
Author: frack113, Florian Roth (Nextron Systems) · 2021-07-21 (modified 2023-02-08) · logsource: product=windows category=process_creation · e31033fc-33f0-4020-9a16-faf9b31cbf08
Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Techniques: T1095
Suspicious DNS Z Flag Bit Set mediumtest
Author: @neu5ron, SOC Prime Team, Corelight · 2021-05-04 (modified 2022-11-29) · logsource: product=zeek service=dns · ede05abc-2c9e-4624-9944-9ff17fdc0bf5
The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
Techniques: T1095T1571