CmdID

CmdID / Techniques

T1095 Non-Application Layer Protocol

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. MITRE ATT&CK

1 Sigma rule T1095 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first
highPUA - Netcat Suspicious Executionfrack113, Florian Roth (Nextron Systems) · Windows