// MITRE ATT&CK
T1071 · Application Layer Protocol
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversari...
¿Cómo detectarlo y mitigarlo?
La detección de Application Layer Protocol parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (5)
T1071.001
Web Protocols T1071.002
File Transfer Protocols T1071.003
Mail Protocols T1071.004
DNS T1071.005
Publish/Subscribe Protocols
Web Protocols T1071.002
File Transfer Protocols T1071.003
Mail Protocols T1071.004
DNS T1071.005
Publish/Subscribe Protocols
Técnicas relacionadas
T1132.001
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1219
Remote Access Tools T1572
Protocol Tunneling
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1219
Remote Access Tools T1572
Protocol Tunneling
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.