MITRE ATT&CK technique · Command and Control

`T1001.003` Protocol or Service Impersonation

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Lazarus Group

Sigma rules to hunt it

Suspicious LDAP-Attributes Usedhightest · windows
ADSI-Cache File Creation By Uncommon Toolmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.