Application Layer Protocol
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enc...
BY SOURCE
PROCEDURES (55)
Auto-extracted: 6 detections for command and control
Auto-extracted: 5 detections for network connection monitoring
Auto-extracted: 4 detections for service
Auto-extracted: 3 detections for parent process
Auto-extracted: 3 detections for dns
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for container
Auto-extracted: 3 detections for beacon
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for process creation monitoring
Auto-extracted: 3 detections for bypass
Auto-extracted: 3 detections for email
Auto-extracted: 3 detections for named pipe
Auto-extracted: 3 detections for unusual
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for http
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for spray
Auto-extracted: 2 detections for dns
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for container
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for module load monitoring
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for beacon
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for child process