Application Layer Protocol
- ID
- T1071
- Tactics
- TA0011 Command and Control
- Platforms
- Linux, macOS, Windows, Network Devices, ESXi
- Data sources
- Network Traffic Content, Network Connection Creation, Process Creation, Network Traffic Flow, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 4 Sep 2026
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.[1]
Sub-techniques (5)
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1071.004 DNS
- T1071.005 Publish/Subscribe Protocols
Detection
- DET0444 Detection of Command and Control Over Application Layer Protocols
Data components: Network Traffic Content, Network Connection Creation, Process Creation, Network Traffic Flow, Command Execution
Mitigations (2)
- M1031 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1037 Filter Network Traffic
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
Groups (6)
Software (10)
- S0034 NETEAGLE
- S0038 Duqu
- S0532 Lucifer
- S0601 Hildegard
- S0623 Siloscape
- S0633 Sliver
- S0660 Clambling
- S1084 QUIETEXIT
- S1130 Raspberry Robin
- S1147 Nightdoor