Técnica MITRE ATT&CK · Mando y control

`T1095` Non-Application Layer Protocol

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP),…

Ficha en MITRE ATT&CK ↗

Quién la usa · con noticias en Jábega

HAFNIUM

Reglas Sigma para cazarla

PUA - Netcat Suspicious Executionhightest · windows
Netcat The Powershell Versionmediumtest · windows
Suspicious DNS Z Flag Bit Setmediumtest · zeek

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.