T1071.001sub-technique of T1071 Application Layer Protocol
Web Protocols
ESXi · Linux · macOS · Network Devices · Windows1 piece on this siteT1071.001 on attack.mitre.org
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma network pack: four rules for DNS, proxy and firewall logs
Long DNS labels, scripting-engine user agents at the proxy, executables fetched from a bare IP address, and SMB leaving the network. Written for the log sources most estates already collect and rarely alert on.
how MITRE says to see it
Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
- Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.
- Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.
- Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).
- Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1037 Filter Network Traffic. Restrict and monitor outbound web traffic (HTTP/HTTPS) from critical servers to only approved destinations. Limiting the ability to initiate outbound HTTP/HTTPS connections, especially from public-facing servers, can prevent attackers from using tools like curl or wget to communicate with external C2 servers or download malicious payloads.