Description
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Platforms
Mitigations (2)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Filter Network TrafficM1037
Restrict and monitor outbound web traffic (HTTP/HTTPS) from critical servers to only approved destinations. Limiting the ability to initiate outbound HTTP/HTTPS connections, especially from public-facing servers, can prevent attackers from using tools like curl or wget to communicate with external C2 servers or download malicious payloads.
Threat Groups (57)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.(Citation: FireEye APT3... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) collected victim device information then transmitted this via HTTP POST to command and control infr... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used HTTP GET and POST requests for C2.(Citation: Talos Kimsuky Nov 2021)(Citation: Aryaka Kimsu... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.(Citation: FireEye APT41 ... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download add... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has used open-source C2 frameworks, including [Covenant](https://attack.mitre.org/software/S1155).(Ci... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used HTTP for C2 communications.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micr... |
| G1042 | RedEcho | [RedEcho](https://attack.mitre.org/groups/G1042) network activity is associated with SSL traffic via TCP 443 and proxied HTTP traffic over non-standar... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used HTTP and HTTPS for C2 communications.(Citation: Palo Alto Gamaredon Feb 2017)(Citati... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download n... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034)'s BCS-server tool connects to the designated C2 server via HTTP.(Citation: ESET Telebots Dec 20... |
| G0026 | APT18 | [APT18](https://attack.mitre.org/groups/G0026) uses HTTP for C2 communications.(Citation: PaloAlto DNS Requests May 2016) |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used HTTP in C2 communications.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidew... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has communicated with its C2 via HTTP POST requests.(Citation: Anomali MUSTANG PANDA October 20... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) has executed wget and curl commands to Pastebin over the HTTPS protocol.(Citation: Anomali Rocke March ... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used HTTP in communications with C2.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT... |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067) uses HTTPS to conceal C2 communications.(Citation: Talos Group123) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used HTTP for C2.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) used HTTP and HTTPS to send data back to its C2 server.(Citation: Malwarebytes Higaisa 2020)(Citation... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) has used HTTP in communication with the C2.(Citation: Anomali Pirate Panda April 2020)(Citatio... |
Associated Software (344)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most o... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has used HTTPS over port 443 for command and control.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can use HTTP for C2 communications.(Citation: Kaspersky ToddyCat June 2022) |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can use HTTP in C2 communications.(Citation: Trend Micro DRBControl February 2020)(Citation: Prof... |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) has used HTTP POST requests to communicate with its C2 server to receive commands.(Citation: Unit42 M... |
| S0686 | QuietSieve | Malware | [QuietSieve](https://attack.mitre.org/software/S0686) can use HTTPS in C2 communications.(Citation: Microsoft Actinium February 2022) |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has communicated to hardcoded C2 through WebSockets (WSS) to include domains associated with Clo... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has used HTTP for C2 communications.(Citation: BlackBerry Amadey 2020) |
| S1192 | NICECURL | Malware | [NICECURL](https://attack.mitre.org/software/S1192) has used HTTPS for C2 communications.(Citation: Mandiant APT42-untangling) |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) uses HTTP over SSL to communicate commands with the control server.(Citation: McAfee GhostSecret) |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) can use HTTP and HTTPS for C2 communications.(Citation: McAfee Lazarus Nov 2020) |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) has used HTTP for C2 communications.(Citation: Unit 42 NOKKI Sept 2018) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) uses HTTP to communicate with a command and control server. (Citation: Nicolas Falliere, Liam O Mur... |
| S9029 | IronWind | Malware | [IronWind](https://attack.mitre.org/software/S9029) can used HTTP to send information to C2 about the targeted system.(Citation: Check Point Wirte NOV... |
| S0460 | Get2 | Malware | [Get2](https://attack.mitre.org/software/S0460) has the ability to use HTTP to send information collected from an infected host to C2.(Citation: Proof... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) can use HTTP for C2 communications.(Citation: FireEye APT34 Dec 2017)(Citation: FireEye APT34 Webi... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) has used HTTP POST requests to send data to C2.(Citation: Mandiant Suspected Turla Campaign Febru... |
| S1105 | COATHANGER | Malware | [COATHANGER](https://attack.mitre.org/software/S1105) uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.(Citation:... |
| S0226 | Smoke Loader | Malware | [Smoke Loader](https://attack.mitre.org/software/S0226) uses HTTP for C2.(Citation: Malwarebytes SmokeLoader 2016) |
| S0466 | WindTail | Malware | [WindTail](https://attack.mitre.org/software/S0466) has the ability to use HTTP for C2 communications.(Citation: objective-see windtail2 jan 2019) |
Related CWE Weaknesses
References
- Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- Shahar Tavor. (n.d.). BrazKing Android Malware Upgraded and Targeting Brazilian Banks. Retrieved March 24, 2023.
Frequently Asked Questions
What is T1071.001 (Web Protocols)?
T1071.001 is a MITRE ATT&CK technique named 'Web Protocols'. It belongs to the Command and Control tactic(s). Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and...
How can T1071.001 be detected?
Detection of T1071.001 (Web Protocols) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1071.001?
There are 2 documented mitigations for T1071.001. Key mitigations include: Network Intrusion Prevention, Filter Network Traffic.
Which threat groups use T1071.001?
Known threat groups using T1071.001 include: APT38, BlackByte, Kimsuky, APT41, APT32, HAFNIUM, MuddyWater, RedEcho.