T1071 Application Layer Protocol

Technique

T1071

Tactics

Command and Control

Research, 90 days

5

KEV CVEs mapped

1

SigmaHQ rules

7

Elastic, Splunk

111

thrunt rules

0

Active families

ACRStealer, AgentTesla, AsyncRAT, Formbook, Lumma, QuasarRAT, Remcos, Stealc, Vidar, XWorm, njRAT

Upstream

https://attack.mitre.org/techniques/T1071

MITRE description

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2021-45382

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-09-24 FortiGuard Labs: Uncovering a SectopRAT Variant Embedded in Legitimate Software
• 2026-09-21 Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
• 2026-08-23 Darktrace: When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar
• 2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

• GALLIUM IOCs (emerging-threats)
• GALLIUM Artefacts - Builtin (emerging-threats)
• Suspicious Installer Package Child Process (core)
• HackTool - SILENTTRINITY Stager DLL Load (core)
• Github Self-Hosted Runner Execution (core)
• HackTool - SILENTTRINITY Stager Execution (core)
• Potentially Suspicious Rundll32.EXE Execution of UDL File (core)

Elastic and Splunk rules

• Potential Tunneling via AWS IoT Secure Tunneling Localproxy (elastic)
• Curl or Wget Spawned via Node.js (elastic)
• GenAI Process Connection to Suspicious Top Level Domain (elastic)
• GenAI Process Connection to Unusual Domain (elastic)
• PANW and Elastic Defend - Command and Control Correlation (elastic)
• Suricata and Elastic Defend Network Correlation (elastic)
• Uncommon DNS Request via Bun or Node.js (elastic)
• Execution via OpenClaw Agent (elastic)
• Web Server Potential Command Injection Request (elastic)
• Web Server Potential SQL Injection Request (elastic)
• Anthropic Activity from a Suspicious User Agent (elastic)
• Entra ID Protection - Risk Detection - Sign-in Risk (elastic)
• Entra ID Protection - Risk Detection - User Risk (elastic)
• Statistical Model Detected C2 Beaconing Activity (elastic)
• Statistical Model Detected C2 Beaconing Activity with High Confidence (elastic)
• File Download Detected via Defend for Containers (elastic)
• Suspicious Process Execution Detected via Defend for Containers (elastic)
• File Creation and Execution Detected via Defend for Containers (elastic)
• System Path File Creation and Execution Detected via Defend for Containers (elastic)
• Payload Execution via Shell Pipe Detected by Defend for Containers (elastic)
• Suspicious Interpreter Execution Detected via Defend for Containers (elastic)
• Web Server Exploitation Detected via Defend for Containers (elastic)
• Machine Learning Detected DGA activity using a known SUNBURST DNS domain (elastic)
• Potential DGA Activity (elastic)
• Machine Learning Detected a DNS Request With a High DGA Probability Score (elastic)

Showing 25 of 111.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.