T1071.001 Web Protocols
sub-techniqueEnterpriseAdversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
Isolate
Deceive
Restore
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringmoderate · backed by 5 of 15 mapped controls
- PR.DSData Securitymoderate · backed by 4 of 15 mapped controls
- PR.PSPlatform Securitymoderate · backed by 3 of 15 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (15)
Security controls that mitigate this.
known-exploited CVEs (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-4577US | critical9.8OT critical | KEV | ||
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m… | ||||
| CVE-2024-4978US | high8.4OT critical | KEV | ||
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor m… | ||||
| CVE-2023-38035US | critical9.8OT critical | KEV | ||
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administra… | ||||
| CVE-2023-26360US | —OT critical | KEV | ||
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code… | ||||
| CVE-2022-42475US | critical9.8OT critical | KEV | ||
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier an… | ||||
| CVE-2021-40449US | medium4.6OT critical | KEV | ||
Win32k Elevation of Privilege Vulnerability | ||||
| CVE-2021-35394US | critical9.8OT critical | KEV | ||
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memo… | ||||
| CVE-2015-5119US | critical9.8OT critical | KEV | ||
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows… | ||||
| CVE-2015-3113US | critical9.8OT critical | KEV | ||
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attack… | ||||
| CVE-2009-4324US | high7.8OT critical | KEV | ||
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remo… | ||||
groups (58)
Threat groups associated with this.
software (352)
Malware and tools associated with this.
campaigns (21)
Campaigns that use this.
Detected by (Sigma) (42)
Sigma detection rules related to this.
source
Where this definition is published.