Applied Cybernetics Group
T1095 Non-Application Layer Protocol
- Technique
T1095- Tactics
- Command and Control
- Research, 90 days
- 4
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 3
- Elastic, Splunk
- 22
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1095
MITRE description
Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL). ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications. In ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host’s backdoor, regardless of network segmentation or firewall rules in place.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-22Group-IB: Inside SiriusQT: A Seriously Skilled RAT -
2026-09-17ESET: Beware the SparroWock: The backdoor that bites, the commands that catch -
2026-09-14Group-IB: Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit -
2026-09-03Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
Detection coverage
SigmaHQ community rules
- Suspicious DNS Z Flag Bit Set (core)
- Netcat The Powershell Version (core)
- PUA - Netcat Suspicious Execution (core)
Elastic and Splunk rules
- Potential Reverse Shell Activity via Terminal (elastic)
- Suspicious React Server Child Process (elastic)
- Azure AKS Pod Exec Potential Reverse Shell (elastic)
- Netcat File Transfer or Listener Detected via Defend for Containers (elastic)
- Suspicious Interpreter Execution Detected via Defend for Containers (elastic)
- Web Server Exploitation Detected via Defend for Containers (elastic)
- GKE Pod Exec Potential Reverse Shell (elastic)
- Network Activity Detected via cat (elastic)
- File Transfer or Listener Established via Netcat (elastic)
- Netcat Listener Established via rlwrap (elastic)
- Network Connection via Recently Compiled Executable (elastic)
- Potential Reverse Shell via Background Process (elastic)
- Potential Reverse Shell via Child (elastic)
- Potential Reverse Shell via Suspicious Child Process (elastic)
- Potential Reverse Shell via Suspicious Binary (elastic)
- Potential Reverse Shell (elastic)
- Potential Reverse Shell via UDP (elastic)
- Network Connection Initiated by Suspicious SSHD Child Process (elastic)
- Newly Observed IPSEC NAT Traversal Peer (elastic)
- Potential ICMP Tunneling Activity to the Internet (elastic)
- Potential Command Shell via NetCat (elastic)
- Linux Proxy Socks Curl (splunk)