T1071 Application Layer Protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. MITRE ATT&CK

1 program on CmdID 4 Sigma rules T1071 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1071.001Application Layer Protocol: Web Protocols

T1071.004Application Layer Protocol: DNS

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

rundll32.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highHackTool - SILENTTRINITY Stager ExecutionAleksey Potapov, oscd.community · Windows

mediumGithub Self-Hosted Runner ExecutionDaniel Koifman (KoifSec) · Windows

mediumPotentially Suspicious Rundll32.EXE Execution of UDL File@kostastsale · Windows

mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r) · macOS