CmdID / Techniques / T1071

T1071.001 Application Layer Protocol: Web Protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. MITRE ATT&CK

1 program on CmdID 9 Sigma rules T1071.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1071Application Layer Protocol

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

curlits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highKalambur Backdoor Curl TOR SOCKS Proxy ExecutionArda Buyukkaya (EclecticIQ) · Windows

highRenamed Visual Studio Code Tunnel ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

mediumCurl.EXE Execution With Custom UserAgentfrack113 · Windows

mediumSuspicious Curl Change User Agents - LinuxNasreddine Bencherchali (Nextron Systems) · Linux

mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r) · macOS

mediumTunneling Tool ExecutionDaniil Yugoslavskiy, oscd.community · Windows

mediumVisual Studio Code Tunnel ExecutionNasreddine Bencherchali (Nextron Systems), citron_ninja · Windows

mediumVisual Studio Code Tunnel Service InstallationNasreddine Bencherchali (Nextron Systems) · Windows

mediumVisual Studio Code Tunnel Shell ExecutionNasreddine Bencherchali (Nextron Systems) · Windows