Application Layer Protocol: Web Protocols

ID: T1071.001
Tactics: TA0011 Command and Control
Sub-technique of: T1071 Application Layer Protocol
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Data sources: Network Traffic Content, Network Connection Creation, Process Creation, Network Traffic Flow, Command Execution
Source: attack.mitre.org
MITRE last modified: 12 Sep 2026

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as HTTP/S^[1] and WebSocket^[2] that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Detection

DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
Data components: Network Traffic Content, Network Connection Creation, Process Creation, Network Traffic Flow, Command Execution

Mitigations (2)

M1031 Network Intrusion Prevention: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
M1037 Filter Network Traffic: Restrict and monitor outbound web traffic (HTTP/HTTPS) from critical servers to only approved destinations. Limiting the ability to initiate outbound HTTP/HTTPS connections, especially from public-facing servers, can prevent attackers from using tools like curl or wget to communicate with external C2 servers or download malicious payloads.

Groups (58)

Software (352)

Showing 60 of 352. Full list on attack.mitre.org.