// MITRE ATT&CK
T1071.005 · Publish/Subscribe Protocols
Sub-technique of T1071 · Application Layer Protocol.
Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client...
How to detect & mitigate it
Detecting Publish/Subscribe Protocols starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1132.001
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools T1572
Protocol Tunneling
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools T1572
Protocol Tunneling
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.