MITRE ATT&CK - Техника Веб-протоколы

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Application Layer Protocol: Веб-протоколы

Other sub-techniques of Application Layer Protocol (4)

ID	Название
.001	Веб-протоколы
.002	Протоколы передачи файлов
.003	Протоколы эл. почты
.004	DNS

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

ID: T1071.001

Относится к технике: T1071

Тактика(-и): Command and Control

Платформы: Linux, macOS, Windows

Источники данных: Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Версия: 1.0

Дата создания: 15 Mar 2020

Последнее изменение: 26 Mar 2020

Название	Описание
Примеры процедур
Mori	Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
UPPERCUT	UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers.(Citation: FireEye APT10 Sept 2018)
RDAT	RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.(Citation: Unit42 RDAT July 2020)
Vasport	Vasport creates a backdoor by making a connection using a HTTP POST.(Citation: Symantec Vasport May 2012)
Drovorub	Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.(Citation: NSA/FBI Drovorub August 2020)
ChChes	ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)
CreepyDrive	CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.(Citation: Microsoft POLONIUM June 2022)
Epic	Epic uses HTTP and HTTPS for C2 communications.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)
Mongall	Mongall can use HTTP for C2 communication.(Citation: SentinelOne Aoqin Dragon June 2022)
Xbash	Xbash uses HTTP for C2 communications.(Citation: Unit42 Xbash Sept 2018)
SUPERNOVA	SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.(Citation: Guidepoint SUPERNOVA Dec 2020)(Citation: Unit42 SUPERNOVA Dec 2020)
xCaon	xCaon has communicated with the C2 server by sending POST requests over HTTP.(Citation: Checkpoint IndigoZebra July 2021)
Rancor	Rancor has used HTTP for C2.(Citation: Rancor Unit42 June 2018)
QUADAGENT	QUADAGENT uses HTTPS and HTTP for C2 communications.(Citation: Unit 42 QUADAGENT July 2018)
Kinsing	Kinsing has communicated with C2 over HTTP.(Citation: Aqua Kinsing April 2020)
BADNEWS	BADNEWS establishes a backdoor over HTTP.(Citation: PaloAlto Patchwork Mar 2018)
BITTER	BITTER has used HTTP POST requests for C2.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)
Bankshot	Bankshot uses HTTP for command and control communication.(Citation: McAfee Bankshot)
MacSpy	MacSpy uses HTTP for command and control.(Citation: objsee mac malware 2017)
LOWBALL	LOWBALL command and control occurs via HTTPS over port 443.(Citation: FireEye admin@338)
QuietSieve	QuietSieve can use HTTPS in C2 communications.(Citation: Microsoft Actinium February 2022)
POWRUNER	POWRUNER can use HTTP for C2 communications.(Citation: FireEye APT34 Dec 2017)(Citation: FireEye APT34 Webinar Dec 2017)
OilRig	OilRig has used HTTP for C2.(Citation: Unit 42 Playbook Dec 2017)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)
CORESHELL	CORESHELL can communicate over HTTP for C2.(Citation: FireEye APT28)(Citation: Microsoft SIR Vol 19)
Metamorfo	Metamorfo has used HTTP for C2.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019)
PoshC2	PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.(Citation: GitHub PoshC2)
ComRAT	ComRAT has used HTTP requests for command and control.(Citation: NorthSec 2015 GData Uroburos Tools)(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020)
BLINDINGCAN	BLINDINGCAN has used HTTPS over port 443 for command and control.(Citation: US-CERT BLINDINGCAN Aug 2020)
More_eggs	More_eggs uses HTTPS for C2.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)
Proxysvc	Proxysvc uses HTTP over SSL to communicate commands with the control server.(Citation: McAfee GhostSecret)
Crutch	Crutch has conducted C2 communications with a Dropbox account using the HTTP API.(Citation: ESET Crutch December 2020)
PcShare	PcShare has used HTTP for C2 communication.(Citation: Bitdefender FunnyDream Campaign November 2020)
Orangeworm	Orangeworm has used HTTP for C2.(Citation: Symantec Orangeworm IOCs April 2018)
Out1	Out1 can use HTTP and HTTPS in communications with remote hosts.(Citation: Trend Micro Muddy Water March 2021)
APT37	APT37 uses HTTPS to conceal C2 communications.(Citation: Talos Group123)
Cobalt Strike	Cobalt Strike uses a custom command and control protocol that can be encapsulated in HTTP or HTTPS, or DNS. All protocols use their standard assigned ports.(Citation: cobaltstrike manual)
Carbanak	The Carbanak malware communicates to its command server using HTTP with an encrypted payload.(Citation: Kaspersky Carbanak)
SNUGRIDE	SNUGRIDE communicates with its C2 server over HTTP.(Citation: FireEye APT10 April 2017)
PLEAD	PLEAD has used HTTP for communications with command and control (C2) servers.(Citation: JPCert PLEAD Downloader June 2018)(Citation: TrendMicro BlackTech June 2017)
VERMIN	VERMIN uses HTTP for C2 communications.(Citation: Unit 42 VERMIN Jan 2018)
CozyCar	CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.(Citation: F-Secure CozyDuke)
Dark Caracal	Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.(Citation: Lookout Dark Caracal Jan 2018)
SLOTHFULMEDIA	SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
EvilBunny	EvilBunny has executed C2 commands directly via HTTP.(Citation: Cyphort EvilBunny Dec 2014)
China Chopper	China Chopper's server component executes code sent via HTTP POST commands.(Citation: FireEye Periscope March 2018)
FatDuke	FatDuke can be controlled via a custom C2 protocol over HTTP.(Citation: ESET Dukes October 2019)
Hi-Zor	Hi-Zor communicates with its C2 server over HTTPS.(Citation: Fidelis INOCNATION)
pngdowner	pngdowner uses HTTP for command and control.(Citation: CrowdStrike Putter Panda)
Ixeshe	Ixeshe uses HTTP for command and control.(Citation: Moran 2013)(Citation: Trend Micro IXESHE 2012)
DustySky	DustySky has used both HTTP and HTTPS for C2.(Citation: DustySky)
TSCookie	TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.(Citation: JPCert BlackTech Malware September 2019)(Citation: JPCert TSCookie March 2018)
BUBBLEWRAP	BUBBLEWRAP can communicate using HTTP or HTTPS.(Citation: FireEye admin@338)
3PARA RAT	3PARA RAT uses HTTP for command and control.(Citation: CrowdStrike Putter Panda)
BlackMould	BlackMould can send commands to C2 in the body of HTTP POST requests.(Citation: Microsoft GALLIUM December 2019)
Magic Hound	Magic Hound malware has used HTTP for C2.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)
Peppy	Peppy can use HTTP to communicate with C2.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Diavol	Diavol has used HTTP GET and POST requests for C2.(Citation: Fortinet Diavol July 2021)
Winnti for Linux	Winnti for Linux has used HTTP in outbound communications.(Citation: Chronicle Winnti for Linux May 2019)
Regin	The Regin malware platform supports many standard protocols, including HTTP and HTTPS.(Citation: Kaspersky Regin)
ThiefQuest	ThiefQuest uploads files via unencrypted HTTP. (Citation: wardle evilquest partii)(Citation: reed thiefquest ransomware analysis)
Tomiris	Tomiris can use HTTP to establish C2 communications.(Citation: Kaspersky Tomiris Sep 2021)
Ramsay	Ramsay has used HTTP for C2.(Citation: Antiy CERT Ramsay April 2020)
RainyDay	RainyDay can use HTTP in C2 communications.(Citation: Bitdefender Naikon April 2021)
Tropic Trooper	Tropic Trooper has used HTTP in communication with the C2.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)
Taidoor	Taidoor has used HTTP GET and POST requests for C2.(Citation: TrendMicro Taidoor)
ZxShell	ZxShell has used HTTP for C2 connections.(Citation: Talos ZxShell Oct 2014)
Action RAT	Action RAT can use HTTP to communicate with C2 servers.(Citation: MalwareBytes SideCopy Dec 2021)
CreepySnail	CreepySnail can use HTTP for C2.(Citation: Microsoft POLONIUM June 2022)
LiteDuke	LiteDuke can use HTTP GET requests in C2 communications.(Citation: ESET Dukes October 2019)
KONNI	KONNI has used HTTP POST for C2.(Citation: Talos Konni May 2017)(Citation: Malwarebytes Konni Aug 2021)
BadPatch	BadPatch uses HTTP for C2.(Citation: Unit 42 BadPatch Oct 2017)
Seasalt	Seasalt uses HTTP for C2 communications.(Citation: Mandiant APT1 Appendix)
Keydnap	Keydnap uses HTTPS for command and control.(Citation: synack 2016 review)
PingPull	A PingPull variant can communicate with its C2 servers by using HTTPS.(Citation: Unit 42 PingPull Jun 2022)
Chimera	Chimera has used HTTPS for C2 communications.(Citation: NCC Group Chimera January 2021)
Okrum	Okrum uses HTTP for communication with its C2.(Citation: ESET Okrum July 2019)
CHOPSTICK	Various implementations of CHOPSTICK communicate with C2 over HTTP.(Citation: ESET Sednit Part 2)
PinchDuke	PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.(Citation: F-Secure The Dukes)
Dacls	Dacls can use HTTPS in C2 communications.(Citation: SentinelOne Lazarus macOS July 2020)(Citation: TrendMicro macOS Dacls May 2020)
Sakula	Sakula uses HTTP for C2.(Citation: Dell Sakula)
Saint Bot	Saint Bot has used HTTP for C2 communications.(Citation: Malwarebytes Saint Bot April 2021)
POWERTON	POWERTON has used HTTP/HTTPS for C2 traffic.(Citation: FireEye APT33 Guardrail)
Mythic	Mythic supports HTTP-based C2 profiles.(Citation: Mythc Documentation)
ServHelper	ServHelper uses HTTP for C2.(Citation: Proofpoint TA505 Jan 2019)
Valak	Valak has used HTTP in communications with C2.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)
CloudDuke	One variant of CloudDuke uses HTTP and HTTPS for C2.(Citation: F-Secure The Dukes)
GravityRAT	GravityRAT uses HTTP for C2.(Citation: Talos GravityRAT)
DEATHRANSOM	DEATHRANSOM can use HTTPS to download files.(Citation: FireEye FiveHands April 2021)
Dridex	Dridex has used POST requests and HTTPS for C2 communications.(Citation: Kaspersky Dridex May 2017)(Citation: Checkpoint Dridex Jan 2021)
AppleJeus	AppleJeus has sent data to its C2 server via `POST` requests.(Citation: CISA AppleJeus Feb 2021)(Citation: ObjectiveSee AppleJeus 2019)
Exaramel for Linux	Exaramel for Linux uses HTTPS for C2 communications.(Citation: ESET TeleBots Oct 2018)(Citation: ANSSI Sandworm January 2021)
4H RAT	4H RAT uses HTTP for command and control.(Citation: CrowdStrike Putter Panda)
HAMMERTOSS	The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.(Citation: FireEye APT29)
	During Operation Wocao, threat actors’ XServer tool communicated using HTTP and HTTPS.(Citation: FoxIT Wocao December 2019)
HAWKBALL	HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.(Citation: FireEye HAWKBALL Jun 2019)
Smoke Loader	Smoke Loader uses HTTP for C2.(Citation: Malwarebytes SmokeLoader 2016)
Felismus	Felismus uses HTTP for C2.(Citation: Forcepoint Felismus Mar 2017)
BoomBox	BoomBox has used HTTP POST requests for C2.(Citation: MSTIC Nobelium Toolset May 2021)
P.A.S. Webshell	P.A.S. Webshell can issue commands via HTTP POST.(Citation: ANSSI Sandworm January 2021)
GreyEnergy	GreyEnergy uses HTTP and HTTPS for C2 communications.(Citation: ESET GreyEnergy Oct 2018)
Aria-body	Aria-body has used HTTP in C2 communications.(Citation: CheckPoint Naikon May 2020)
Helminth	Helminth can use HTTP for C2.(Citation: Palo Alto OilRig May 2016)
JHUHUGIT	JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)(Citation: Unit 42 Playbook Dec 2017)
APT19	APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.(Citation: FireEye APT19)(Citation: Unit 42 C0d0so0 Jan 2016)
APT41	APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.(Citation: FireEye APT41 March 2020)
SoreFang	SoreFang can use HTTP in C2 communications.(Citation: CISA SoreFang July 2016)(Citation: NCSC APT29 July 2020)
Mustang Panda	Mustang Panda has communicated with its C2 via HTTP POST requests.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: McAfee Dianxun March 2021)
S-Type	S-Type uses HTTP for C2.(Citation: Cylance Dust Storm)
HyperBro	HyperBro has used HTTPS for C2 communications.(Citation: Unit42 Emissary Panda May 2019)
RGDoor	RGDoor uses HTTP for C2 communications.(Citation: Unit 42 RGDoor Jan 2018)
Pteranodon	Pteranodon can use HTTP for C2.(Citation: Palo Alto Gamaredon Feb 2017)
ABK	ABK has the ability to use HTTP in communications with C2.(Citation: Trend Micro Tick November 2019)
FELIXROOT	FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
Koadic	Koadic has used HTTP for C2 communications.(Citation: MalwareBytes LazyScripter Feb 2021)
APT38	APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.(Citation: FireEye APT38 Oct 2018)
BACKSPACE	BACKSPACE uses HTTP as a transport to communicate with its command server.(Citation: FireEye APT30)
RATANKBA	RATANKBA uses HTTP/HTTPS for command and control communication.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
BBK	BBK has the ability to use HTTP in communications with C2.(Citation: Trend Micro Tick November 2019)
Psylo	Psylo uses HTTPS for C2.(Citation: Scarlet Mimic Jan 2016)
BRONZE BUTLER	BRONZE BUTLER malware has used HTTP for C2.(Citation: Secureworks BRONZE BUTLER Oct 2017)
WindTail	WindTail has the ability to use HTTP for C2 communications.(Citation: objective-see windtail2 jan 2019)
MechaFlounder	MechaFlounder has the ability to use HTTP in communication with C2.(Citation: Unit 42 MechaFlounder March 2019)
FoggyWeb	FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.(Citation: MSTIC FoggyWeb September 2021)
QakBot	QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.(Citation: Trend Micro Qakbot May 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: Kaspersky QakBot September 2021)
Agent Tesla	Agent Tesla has used HTTP for C2 communications.(Citation: DigiTrust Agent Tesla Jan 2017)(Citation: Fortinet Agent Tesla June 2017)
Crimson	Crimson can use a HTTP GET request to download its final payload.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Sidewinder	Sidewinder has used HTTP in C2 communications.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)
Gazer	Gazer communicates with its C2 servers over HTTP.(Citation: ESET Gazer Aug 2017)
NETEAGLE	NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.(Citation: FireEye APT30)
WhisperGate	WhisperGate can make an HTTPS connection to download additional files.(Citation: Unit 42 WhisperGate January 2022)(Citation: Medium S2W WhisperGate January 2022)
UBoatRAT	UBoatRAT has used HTTP for C2 communications.(Citation: PaloAlto UBoatRAT Nov 2017)
CSPY Downloader	CSPY Downloader can use GET requests to download additional payloads from C2.(Citation: Cybereason Kimsuky November 2020)
Kimsuky	Kimsuky has used HTTP GET and POST requests for C2.(Citation: Talos Kimsuky Nov 2021)
STARWHALE	STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.(Citation: Mandiant UNC3313 Feb 2022)(Citation: DHS CISA AA22-055A MuddyWater February 2022)
	During Frankenstein, the threat actors used HTTP GET requests for C2.(Citation: Talos Frankenstein June 2019)
Lazarus Group	Lazarus Group has conducted C2 over HTTP and HTTPS.(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: SentinelOne Lazarus macOS July 2020)(Citation: TrendMicro macOS Dacls May 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)(Citation: ESET Twitter Ida Pro Nov 2021)
Avenger	Avenger has the ability to use HTTP in communication with C2.(Citation: Trend Micro Tick November 2019)
AuTo Stealer	AuTo Stealer can use HTTP to communicate with its C2 servers.(Citation: MalwareBytes SideCopy Dec 2021)
Remexi	Remexi uses BITSAdmin to communicate with the C2 server over HTTP.(Citation: Securelist Remexi Jan 2019)
PlugX	PlugX can be configured to use HTTP for command and control.(Citation: Dell TG-3390)(Citation: Proofpoint TA416 Europe March 2022)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D can use HTTP POST and GET requests to send and receive C2 information.(Citation: Trend Micro MacOS Backdoor November 2020)
OopsIE	OopsIE uses HTTP for C2 communications.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)
Zebrocy	Zebrocy uses HTTP for C2.(Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)
PoetRAT	PoetRAT has used HTTP and HTTPs for C2 communications.(Citation: Talos PoetRAT October 2020)
SMOKEDHAM	SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.(Citation: FireEye SMOKEDHAM June 2021)
StrongPity	StrongPity can use HTTP and HTTPS in C2 communications.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
Pandora	Pandora can communicate over HTTP.(Citation: Trend Micro Iron Tiger April 2021)
Donut	Donut can use HTTP to download previously staged shellcode payloads.(Citation: Donut Github)
SpeakUp	SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server. (Citation: CheckPoint SpeakUp Feb 2019)
Higaisa	Higaisa used HTTP and HTTPS to send data back to its C2 server.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)
Milan	Milan can use HTTPS for communication with C2.(Citation: ClearSky Siamesekitten August 2021)(Citation: Kaspersky Lyceum October 2021)(Citation: Accenture Lyceum Targets November 2021)
Emissary	Emissary uses HTTP or HTTPS for C2.(Citation: Lotus Blossom Dec 2015)
Anchor	Anchor has used HTTP and HTTPS in C2 communications.(Citation: Cyberreason Anchor December 2019)
MCMD	MCMD can use HTTPS in communication with C2 web servers.(Citation: Secureworks MCMD July 2019)
ELMER	ELMER uses HTTP for command and control.(Citation: FireEye EPS Awakens Part 2)
MuddyWater	MuddyWater has used HTTP for C2 communications.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)
Stealth Falcon	Stealth Falcon malware communicates with its C2 server via HTTPS.(Citation: Citizen Lab Stealth Falcon May 2016)
LookBack	LookBack’s C2 proxy tool sends data to a C2 server over HTTP.(Citation: Proofpoint LookBack Malware Aug 2019)
YAHOYAH	YAHOYAH uses HTTP for C2.(Citation: TrendMicro TropicTrooper 2015)
APT32	APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.(Citation: Volexity OceanLotus Nov 2017)(Citation: Cybereason Cobalt Kitty 2017)
Squirrelwaffle	Squirrelwaffle has used HTTP POST requests for C2 communications.(Citation: ZScaler Squirrelwaffle Sep 2021)
Reaver	Some Reaver variants use HTTP for C2.(Citation: Palo Alto Reaver Nov 2017)
DanBot	DanBot can use HTTP in C2 communication.(Citation: SecureWorks August 2019)
Rising Sun	Rising Sun has used HTTP and HTTPS for command and control.(Citation: McAfee Sharpshooter December 2018)
	During Night Dragon, threat actors used HTTP for C2.(Citation: McAfee Night Dragon)
RCSession	RCSession can use HTTP in C2 communications.(Citation: Trend Micro DRBControl February 2020)(Citation: Profero APT27 December 2020)
Comnie	Comnie uses HTTP for C2 communication.(Citation: Palo Alto Comnie)
Inception	Inception has used HTTP, HTTPS, and WebDav in network communications.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Unit 42 Inception November 2018)
BBSRAT	BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.(Citation: Palo Alto Networks BBSRAT)
WIRTE	WIRTE has used HTTP for network communication.(Citation: Lab52 WIRTE Apr 2019)
ShimRat	ShimRat communicated over HTTP and HTTPS with C2 servers.(Citation: FOX-IT May 2016 Mofang)
Dyre	Dyre uses HTTPS for C2 communications.(Citation: Symantec Dyre June 2015)(Citation: Malwarebytes Dyreza November 2015)
Stuxnet	Stuxnet uses HTTP to communicate with a command and control server. (Citation: Symantec W.32 Stuxnet Dossier)
Turla	Turla has used HTTP and HTTPS for C2 communications.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)
Dipsind	Dipsind uses HTTP for C2.(Citation: Microsoft PLATINUM April 2016)
Pupy	Pupy can communicate over HTTP for C2.(Citation: GitHub Pupy)
Flagpro	Flagpro can communicate with its C2 using HTTP.(Citation: NTT Security Flagpro new December 2021)
Machete	Machete uses HTTP for Command & Control.(Citation: ESET Machete July 2019)(Citation: Cylance Machete Mar 2017)(Citation: 360 Machete Sep 2020)
SilverTerrier	SilverTerrier uses HTTP for C2 communications.(Citation: Unit42 SilverTerrier 2018)
APT28	Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.(Citation: FireEye APT28)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
Torisma	Torisma can use HTTP and HTTPS for C2 communications.(Citation: McAfee Lazarus Nov 2020)
Bisonal	Bisonal has used HTTP for C2 communications.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)
SideTwist	SideTwist has used HTTP GET and POST requests over port 443 for C2.(Citation: Check Point APT34 April 2021)
Goopy	Goopy has the ability to communicate with its C2 over HTTP.(Citation: Cybereason Cobalt Kitty 2017)
Machete	Machete malware used Python’s urllib library to make HTTP requests to the C2 server.(Citation: Cylance Machete Mar 2017)
Hikit	Hikit has used HTTP for C2.(Citation: FireEye HIKIT Rootkit Part 2)
Sliver	Sliver has the ability to support C2 communications over HTTP/S.(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Bishop Fox Sliver Framework August 2019)(Citation: GitHub Sliver C2)
Final1stspy	Final1stspy uses HTTP for C2.(Citation: Unit 42 Nokki Oct 2018)
GoldenSpy	GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.(Citation: Trustwave GoldenSpy June 2020)
UNC2452	UNC2452 used HTTP for C2 and data exfiltration.(Citation: Volexity SolarWinds)
TrailBlazer	TrailBlazer has used HTTP requests for C2.(Citation: CrowdStrike StellarParticle January 2022)
Kevin	Variants of Kevin can communicate with C2 over HTTP.(Citation: Kaspersky Lyceum October 2021)
CharmPower	CharmPower can use HTTP to communicate with C2.(Citation: Check Point APT35 CharmPower January 2022)
Wizard Spider	Wizard Spider has used HTTP for network communications.(Citation: CrowdStrike Grim Spider May 2019)
DarkWatchman	DarkWatchman uses HTTPS for command and control.(Citation: Prevailion DarkWatchman 2021)
Ursnif	Ursnif has used HTTPS for C2.(Citation: TrendMicro Ursnif Mar 2015)(Citation: FireEye Ursnif Nov 2017)(Citation: ProofPoint Ursnif Aug 2016)
Empire	Empire can conduct command and control over protocols like HTTP and HTTPS.(Citation: Github PowerShell Empire)
ADVSTORESHELL	ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.(Citation: Kaspersky Sofacy)
FlawedAmmyy	FlawedAmmyy has used HTTP for C2.(Citation: Proofpoint TA505 Mar 2018)
Mis-Type	Mis-Type network traffic can communicate over HTTP.(Citation: Cylance Dust Storm)
Doki	Doki has communicated with C2 over HTTPS.(Citation: Intezer Doki July 20)
Maze	Maze has communicated to hard-coded IP addresses via HTTP.(Citation: McAfee Maze March 2020)
LitePower	LitePower can use HTTP and HTTPS for C2 communications.(Citation: Kaspersky WIRTE November 2021)
WinMM	WinMM uses HTTP for C2.(Citation: Baumgartner Naikon 2015)
SeaDuke	SeaDuke uses HTTP and HTTPS for C2.(Citation: F-Secure The Dukes)
Night Dragon	Night Dragon has used HTTP for C2.(Citation: McAfee Night Dragon)
njRAT	njRAT has used HTTP for C2 communications.(Citation: Trend Micro njRAT 2018)
Micropsia	Micropsia uses HTTP and HTTPS for C2 network communications.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
FIN8	FIN8 has used HTTPS for command and control.(Citation: Bitdefender FIN8 July 2021)
KGH_SPY	KGH_SPY can send data to C2 with HTTP POST requests.(Citation: Cybereason Kimsuky November 2020)
PolyglotDuke	PolyglotDuke has has used HTTP GET requests in C2 communications.(Citation: ESET Dukes October 2019)
Cobalt Strike	Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)(Citation: Securelist APT10 March 2021)
PowerShower	PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.(Citation: Unit 42 Inception November 2018)
httpclient	httpclient uses HTTP for command and control.(Citation: CrowdStrike Putter Panda)
ZeroT	ZeroT has used HTTP for C2.(Citation: Proofpoint TA459 April 2017)(Citation: Proofpoint ZeroT Feb 2017)
Confucius	Confucius has used HTTP for C2 communications.(Citation: Uptycs Confucius APT Jan 2021)
Pony	Pony has sent collected information to the C2 via HTTP POST request.(Citation: Malwarebytes Pony April 2016)
PowGoop	PowGoop can send HTTP GET requests to malicious servers.(Citation: CYBERCOM Iranian Intel Cyber January 2022)
Industroyer	Industroyer’s main backdoor connected to a remote C2 server using HTTPS.(Citation: ESET Industroyer)
CosmicDuke	CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.(Citation: F-Secure The Dukes)(Citation: F-Secure Cosmicduke)
Carbon	Carbon can use HTTP in C2 communications.(Citation: Accenture HyperStack October 2020)
Explosive	Explosive has used HTTP for communication.(Citation: CheckPoint Volatile Cedar March 2015)
Kazuar	Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.(Citation: Unit 42 Kazuar May 2017)
Windshift	Windshift has used tools that communicate with C2 over HTTP.(Citation: BlackBerry Bahamut)
PUNCHBUGGY	PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Morphisec ShellTea June 2019)
HTTPBrowser	HTTPBrowser has used HTTP and HTTPS for command and control.(Citation: Dell TG-3390)(Citation: ThreatStream Evasion Analysis)
RTM	RTM has initiated connections to external domains using HTTPS.(Citation: Unit42 Redaman January 2019)
Cobalt Group	Cobalt Group has used HTTPS for C2.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)
Zeus Panda	Zeus Panda uses HTTP for C2 communications.(Citation: Talos Zeus Panda Nov 2017)
GoldMax	GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
OnionDuke	OnionDuke uses HTTP and HTTPS for C2.(Citation: F-Secure The Dukes)
DarkComet	DarkComet can use HTTP for C2 communications.(Citation: Malwarebytes DarkComet March 2018)
Octopus	Octopus has used HTTP GET and POST requests for C2 communications.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
GeminiDuke	GeminiDuke uses HTTP and HTTPS for command and control.(Citation: F-Secure The Dukes)
GuLoader	GuLoader can use HTTP to retrieve additional binaries.(Citation: Unit 42 NETWIRE April 2020)(Citation: Medium Eli Salem GuLoader April 2021)
Chaes	Chaes has used HTTP for C2 communications.(Citation: Cybereason Chaes Nov 2020)
Turian	Turian has the ability to use HTTP for its C2.(Citation: ESET BackdoorDiplomacy Jun 2021)
	During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.(Citation: Cybereason OperationCuckooBees May 2022)
DRATzarus	DRATzarus can use HTTP or HTTPS for C2 communications.(Citation: ClearSky Lazarus Aug 2020)
IcedID	IcedID has used HTTPS in communications with C2.(Citation: Juniper IcedID June 2020)
REvil	REvil has used HTTP and HTTPS in communication with C2.(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)
Elise	Elise communicates over HTTP or HTTPS for C2.(Citation: Lotus Blossom Jun 2015)
down_new	down_new has the ability to use HTTP in C2 communications.(Citation: Trend Micro Tick November 2019)
BLUELIGHT	BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.(Citation: Volexity InkySquid BLUELIGHT August 2021)
APT33	APT33 has used HTTP for command and control.(Citation: Symantec Elfin Mar 2019)
TA551	TA551 has used HTTP for C2 communications.(Citation: Unit 42 Valak July 2020)
Egregor	Egregor has communicated with its C2 servers via HTTPS protocol.(Citation: Intrinsec Egregor Nov 2020)
VBShower	VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.(Citation: Kaspersky Cloud Atlas August 2019)
IceApple	IceApple can use HTTP GET to request and pull information from C2.(Citation: CrowdStrike IceApple May 2022)
Shark	Shark has the ability to use HTTP in C2 communications.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
AppleSeed	AppleSeed has the ability to communicate with C2 over HTTP.(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi)
Gold Dragon	Gold Dragon uses HTTP for communication to the control servers.(Citation: McAfee Gold Dragon)
Bazar	Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)(Citation: DFIR Conti Bazar Nov 2021)
BackConfig	BackConfig has the ability to use HTTPS for C2 communiations.(Citation: Unit 42 BackConfig May 2020)
RedLeaves	RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.(Citation: FireEye APT10 April 2017)(Citation: Accenture Hogfish April 2018)
APT29	APT29 has used HTTP for C2 and data exfiltration.(Citation: Volexity SolarWinds)
Carberp	Carberp has connected to C2 servers via HTTP.(Citation: Trusteer Carberp October 2010)
Clambling	Clambling has the ability to communicate over HTTP.(Citation: Trend Micro DRBControl February 2020)
RIPTIDE	APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.(Citation: Moran 2014)
NOKKI	NOKKI has used HTTP for C2 communications.(Citation: Unit 42 NOKKI Sept 2018)
Gamaredon Group	Gamaredon Group has used HTTP and HTTPS for C2 communications.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)
ShadowPad	ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.(Citation: Kaspersky ShadowPad Aug 2017)
Sys10	Sys10 uses HTTP for C2.(Citation: Baumgartner Naikon 2015)
MarkiRAT	MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.(Citation: Kaspersky Ferocious Kitten Jun 2021)
OLDBAIT	OLDBAIT can use HTTP for C2.(Citation: FireEye APT28)
Ke3chang	Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)
Komplex	The Komplex C2 channel uses HTTP POST requests.(Citation: Sofacy Komplex Trojan)
Gelsemium	Gelsemium can use HTTP/S in C2 communications.(Citation: ESET Gelsemium June 2021)
FIN4	FIN4 has used HTTP POST requests to transmit data.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)
SUGARDUMP	A SUGARDUMP variant has used HTTP for C2.(Citation: Mandiant UNC3890 Aug 2022)
Cardinal RAT	Cardinal RAT is downloaded using HTTP over port 443.(Citation: PaloAlto CardinalRat Apr 2017)
OwaAuth	OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.(Citation: Dell TG-3390)
OutSteel	OutSteel has used HTTP for C2 communications.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Daserf	Daserf uses HTTP for C2.(Citation: Secureworks BRONZE BUTLER Oct 2017)
NETWIRE	NETWIRE has the ability to communicate over HTTP.(Citation: Red Canary NETWIRE January 2020)(Citation: Proofpoint NETWIRE December 2020)
DownPaper	DownPaper communicates to its C2 server over HTTP.(Citation: ClearSky Charming Kitten Dec 2017)
APT18	APT18 uses HTTP for C2 communications.(Citation: PaloAlto DNS Requests May 2016)
Remsec	Remsec is capable of using HTTP and HTTPS for C2.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)(Citation: Kaspersky ProjectSauron Technical Analysis)
APT39	APT39 has used HTTP in communications with C2.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)
MiniDuke	MiniDuke uses HTTP and HTTPS for command and control.(Citation: F-Secure The Dukes)(Citation: ESET Dukes October 2019)
Threat Group-3390	Threat Group-3390 malware has used HTTP for C2.(Citation: Securelist LuckyMouse June 2018)
Get2	Get2 has the ability to use HTTP to send information collected from an infected host to C2.(Citation: Proofpoint TA505 October 2019)
Winnti for Windows	Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.(Citation: Novetta Winnti April 2015)
HAFNIUM	HAFNIUM has used open-source C2 frameworks, including Covenant.(Citation: Microsoft HAFNIUM March 2020)
Lokibot	Lokibot has used HTTP for C2 communications.(Citation: Infoblox Lokibot January 2019)(Citation: Talos Lokibot Jan 2021)
Small Sieve	Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
InvisiMole	InvisiMole uses HTTP for C2 communications.(Citation: ESET InvisiMole June 2018)
ShimRatReporter	ShimRatReporter communicated over HTTP with preconfigured C2 servers.(Citation: FOX-IT May 2016 Mofang)
Grandoreiro	Grandoreiro has the ability to use HTTP in C2 communications.(Citation: IBM Grandoreiro April 2020)(Citation: ESET Grandoreiro April 2020)
GoldFinder	GoldFinder has used HTTP for C2.(Citation: MSTIC NOBELIUM Mar 2021)
Neoichor	Neoichor can use HTTP for C2 communications.(Citation: Microsoft NICKEL December 2021)
Cyclops Blink	Cyclops Blink can download files via HTTP and HTTPS.(Citation: NCSC Cyclops Blink February 2022)(Citation: Trend Micro Cyclops Blink March 2022)
Amadey	Amadey has used HTTP for C2 communications.(Citation: BlackBerry Amadey 2020)
TinyTurla	TinyTurla can use HTTPS in C2 communications.(Citation: Talos TinyTurla September 2021)
TeamTNT	TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software.(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Cisco Talos Intelligence Group) TeamTNT has also used a custom user agent HTTP header in shell scripts.(Citation: Trend Micro TeamTNT)
Rocke	Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.(Citation: Anomali Rocke March 2019)
TrickBot	TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.(Citation: S2 Grupo TrickBot June 2017)(Citation: Cyberreason Anchor December 2019)
Trojan.Karagany	Trojan.Karagany can communicate with C2 via HTTP POST requests.(Citation: Secureworks Karagany July 2019)
VaporRage	VaporRage can use HTTP to download shellcode from compromised websites.(Citation: MSTIC Nobelium Toolset May 2021)
SUNBURST	SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.(Citation: FireEye SUNBURST Backdoor December 2020)
GrimAgent	GrimAgent has the ability to use HTTP for C2 communications.(Citation: Group IB GrimAgent July 2021)
Shamoon	Shamoon has used HTTP for C2.(Citation: Palo Alto Shamoon Nov 2016)
WellMess	WellMess can use HTTP and HTTPS in C2 communications.(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)(Citation: CISA WellMess July 2020)(Citation: NCSC APT29 July 2020)
DealersChoice	DealersChoice uses HTTP for communication with the C2 server.(Citation: Sofacy DealersChoice)
Spark	Spark has used HTTP POST requests to communicate with its C2 server to receive commands.(Citation: Unit42 Molerat Mar 2020)
ROKRAT	ROKRAT can use HTTP and HTTPS for command and control communication.(Citation: Talos ROKRAT)(Citation: NCCGroup RokRat Nov 2018)(Citation: Malwarebytes RokRAT VBA January 2021)
BlackEnergy	BlackEnergy communicates with its C2 server over HTTP.(Citation: F-Secure BlackEnergy 2014)
Sandworm Team	Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.(Citation: ESET Telebots Dec 2016)
TA505	TA505 has used HTTP to communicate with C2 nodes.(Citation: IBM TA505 April 2020)
ZLib	ZLib communicates over HTTP for C2.(Citation: Cylance Dust Storm)
Bundlore	Bundlore uses HTTP requests for C2.(Citation: MacKeeper Bundlore Apr 2019)
Sibot	Sibot communicated with its C2 server via HTTP GET requests.(Citation: MSTIC NOBELIUM Mar 2021)

Контрмера	Описание
Контрмеры
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.

Обнаружение

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2) Monitor for web traffic to/from known-bad or suspicious domains.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.