MITRE ATT&CK technique · Command and Control

`T1095` Non-Application Layer Protocol

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP),…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

HAFNIUM

Sigma rules to hunt it

PUA - Netcat Suspicious Executionhightest · windows
Netcat The Powershell Versionmediumtest · windows
Suspicious DNS Z Flag Bit Setmediumtest · zeek

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.