T1071.001 Web Protocols

Unter-TechnikEnterprise

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

01

Plattformen

Plattformen, für die dies gilt.

ESXiLinuxmacOSNetwork DevicesWindows
02

Taktiken

ATT&CK-Taktiken, denen diese Technik dient.

03

Unter-Technik von

Die übergeordnete Entität.

T1071Application Layer Protocol
04

Gegenmaßnahmen

ATT&CK-Gegenmaßnahmen, die dies verringern.

06

Abgewehrt durch (D3FEND)

D3FEND-Gegenmaßnahmen dagegen.

07

NIST CSF 2.0 — Relevanzbereiche (Protect / Detect)

NIST-CSF-2.0-Bereiche mit dem größten Bezug (belegbasiert).

Abgeleitet aus MITRE CTID (Apache-2.0) und dem NIST-800-53-↔-CSF-Crosswalk (gemeinfrei). Eine indikative Relevanz entlang der Protect-/Detect-Achse — keine Compliance-Bewertung und keine Abdeckungsaussage.

09

bekannt ausgenutzte CVEs (10)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2024-4577UScritical9.8OT kritischKEV
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m…
CVE-2024-4978UShigh8.4OT kritischKEV
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor m…
CVE-2023-38035UScritical9.8OT kritischKEV
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administra…
CVE-2023-26360US—OT kritischKEV
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code…
CVE-2022-42475UScritical9.8OT kritischKEV
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier an…
CVE-2021-40449USmedium4.6OT kritischKEV
Win32k Elevation of Privilege Vulnerability
CVE-2021-35394UScritical9.8OT kritischKEV
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memo…
CVE-2015-5119UScritical9.8OT kritischKEV
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows…
CVE-2015-3113UScritical9.8OT kritischKEV
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attack…
CVE-2009-4324UShigh7.8OT kritischKEV
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remo…
10

Gruppen (58)

Zugehörige Bedrohungsgruppen.

11

Software (352)

Zugehörige Malware und Tools.

13

Erkannt durch (Sigma) (42)

Zugehörige Sigma-Erkennungsregeln.

20 von 42 angezeigt
14

Quelle

Wo diese Definition veröffentlicht ist.

MITRE ATT&CK