C2 over application-layer protocols
Commands hidden in HTTP(S), DNS, mail, FTP or pub/sub traffic
categoryNetwork and infrastructure attacksseverityHighdetectabilityHighlabnot yet measured
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
sudo /opt/lab/detonate.sh --technique T1071.001 --tool atomic --run-id <run-id> -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1071.001 -TestGuids 2d7c471a-e887-4b78-b0dc-b0df1f2e0658 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'Queued for lab measurement — not yet detonated.
Classification
29 values: 15 reviewed, 13 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Network attacks |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | ESXiLinuxmacOSNetwork DevicesWindows |
| Environment | CloudOn-premises |
| Target asset class | EndpointServer |
| Kill-chain phase (tactic) | Command and Control |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Command ExecutionNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess Creation |
Detection & response
Mitigated by 31
- M1031 attack-mitigation
- M1037 attack-mitigation
D3-APCAd3fendD3-CAd3fendD3-CFd3fendD3-CMd3fendD3-CQd3fendD3-CSPPd3fendD3-DFd3fendD3-DNSALd3fendD3-DNSDLd3fendD3-DNSTAd3fendD3-FAd3fendD3-FCd3fendD3-FEd3fendD3-FEVd3fendD3-FIMd3fendD3-FRDDLd3fendD3-LFPd3fendD3-NTCDd3fendD3-NTFd3fendD3-NTSAd3fendD3-OTFd3fendD3-PHDURAd3fendD3-PMADd3fendD3-RFd3fendD3-RFAMd3fendD3-RPAd3fendD3-RRIDd3fendD3-RTSDd3fendD3-UGLPAd3fend
Detected by 64
- DET0002 attack-detection-strategy
- DET0027 attack-detection-strategy
- DET0135 attack-detection-strategy
- DET0400 attack-detection-strategy
- DET0416 attack-detection-strategy
0d18728b-f5bf-4381-9dcf-915539fff6c2sigma1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20bsigma21e44d78-95e7-421b-a464-ffd8395659c4sigma2975af79-28c4-4d2f-a951-9095f229df29sigma2b1ee7e4-89b6-4739-b7bb-b811b6607e5esigma2cf29f11-e356-4f61-98c0-1bdb9393d6dasigma2fdaf50b-9fd5-449f-ba69-f17248119af6sigma304810ed-8853-437f-9e36-c4975c3dfd7esigma30bf1789-379d-4fdc-900f-55cd0a90a801sigma3286d37a-00fd-41c2-a624-a672dcd34e60sigma37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1sigma3ceb2083-a27f-449a-be33-14ec1b7cc973sigma3eaf6218-3bed-4d8a-8707-274096f12a18sigma4153a907-2451-4e4f-a578-c52bb6881432sigma53ba33fd-3a50-4468-a5ef-c583635cfa92sigma5468045b-4fcc-4d1a-973c-c9c9578edacbsigma5ba715b6-71b7-44fd-8245-f66893e81b3dsigma5c84856b-55a5-45f1-826f-13f37250cf4esigma6b0c762f-0e1b-435f-a829-5943b08fe36asigma6ec820f2-e963-4801-9127-d8b2dce4d31bsigma7195a772-4b3f-43a4-a210-6a003d65caa1sigma73e5d24f-493f-4092-bd2f-c72cabda40eesigma7857f021-007f-4928-8b2c-7aedbe64bb82sigma7bdf2a7c-3acc-4091-9581-0a77dad1c5b5sigma834c6d2f-5e98-4b2a-b453-0c4f234afeddsigma882e858a-3233-4ba8-855e-2f3d3575803dsigma894a8613-cf12-48b3-8e57-9085f54aa0c3sigma8ae51330-899c-4641-8125-e39f2e07da72sigma8ccd35a2-1c7c-468b-b568-ac6cdf80eec3sigma90d6bd71-dffb-4989-8d86-a827fedd6624sigma932ac737-33ca-4afd-9869-0d48b391fcc9sigma98a96a5a-64a0-4c42-92c5-489da3866cb0sigma9c3d6e32-f4c8-4d73-8b8f-95c3b383a13csigma9eb68894-7476-4cd6-8752-23b51f5883a7sigmaa1d9eec5-33b2-4177-8d24-27fe754d0812sigma- … and 24 more in the database
Tested by 7
1700f5d6-5a44-487b-84de-bc66f507b0a6atomic2d7c471a-e887-4b78-b0dc-b0df1f2e0658atomic3efc144e-1af8-46bb-8ca2-1376bb6db8b6atomic81c13829-f6c9-45b8-85a6-053366d55297atomicdc3488b0-08c7-4fea-b585-905c83b48180atomice7bf9802-2e78-4db9-93b5-181b7bcd37d7atomicfef31710-223a-40ee-8462-a396d6b66978atomic
Framework references
- Primary source: https://attack.mitre.org/techniques/T1071/
- attack: T1071.001 (primary)
- attack: T1071.002
- attack: T1071.003
- attack: T1071.004
- attack: T1071.005
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 205 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 26 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 27 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0005 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 422 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0006 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 55 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)