TA0011 · COMMAND AND CONTROL
Application Layer Protocol
HTTP, HTTPS, DNS, and mail protocols carrying command traffic inside ordinary-looking sessions.
Detect it with
Beaconing intervals with low jitter, uniform payload sizes, long-lived connections to rare destinations.
Why it matters on shift
Application Layer Protocol is one of the concrete ways adversaries achieve command and control. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After command and control, the next tactic is usually Exfiltration. Search your telemetry for the transition before closing the ticket.
5 sub-techniques
How it shows up in practice
- T1071.001
Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
- T1071.002
File Transfer Protocols
Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.
- T1071.003
Mail Protocols
Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.
- T1071.004
DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.
- T1071.005
Publish/Subscribe Protocols
Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Kill-chain context