T1001.003 — Protocol or Service Impersonation

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.…

Sub-technique of Data Obfuscation (T1001).

Sigma detection rules (4)

title: "T1001.003 Data Obfuscation: Protocol or Service Impersonation"
id: f9db7b58-3829-491e-898b-53601c972c0a
description: 'Detects non-browser, non-web-client Windows binaries (LOLBins commonly abused for C2: rundll32, regsvr32, mshta, certutil, powershell, wscript, cscript) making outbound network connections on standard web ports (80/443) -- a Windows-observable proxy for adversaries impersonating ordinary HTTP/HTTPS traffic to blend in, since Sysmon does not capture the TLS handshake, certificate, or HTTP header content needed to directly confirm protocol/service impersonation. Retargeted from bare EventID 3/22 matches with no impersonation-specific signal; DNS query matching (EventID 22) was dropped entirely as it added no discriminating value here. Tune using: IssuerOrgFilter, UserContext, HeaderSignatureMatch.'
references:
  - https://attack.mitre.org/techniques/T1001/003
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.003

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'
    DestinationPort:
      - 80
      - 443
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate admin scripting/automation using these binaries to reach internal web APIs or update endpoints over 80/443; scope to unexpected external destinations or unmanaged hosts, and add IssuerOrgFilter/HeaderSignatureMatch (proxy-level TLS inspection) for higher-confidence confirmation of impersonation versus ordinary LOLBin network use.

level: medium

title: "T1001.003 Data Obfuscation: Protocol or Service Impersonation"
id: b0645aef-6687-421e-8ca5-4ccfa5e9cf71
description: 'Detecting Protocol or Service Impersonation via Host/SNI Header Override. True protocol impersonation (fake TLS handshakes, JA3/certificate fingerprint mimicry, wire-level header framing) is a network-payload property that auditd process telemetry cannot inspect at all - the prior version flagged any connect() by socat or openssl, which is generic, legitimate encrypted-tunnel/TLS-testing tool usage with no tie to impersonation, as its own falsepositives note admitted. Retargeted to the one argv-observable proxy available: curl or wget invoked with an explicit Host-header or resolve-override flag (-H "Host: ...", --resolve, --connect-to) naming a well-known trusted service domain (e.g. google.com, microsoft.com) while the actual destination argument points elsewhere - consistent with an attempt to make traffic masquerade as a trusted service. Tune using: TrustedServiceDomainList, ProtocolMatchConfidence.'
references:
  - https://attack.mitre.org/techniques/T1001/003
author: Shahrukh Khan
date: 2026-01-05
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
  selection_override_flag:
    - a1|contains: ['--resolve', '--connect-to', '-H']
    - a2|contains: ['--resolve', '--connect-to', '-H']
    - a3|contains: ['--resolve', '--connect-to', '-H']
  selection_trusted_domain_spoofed:
    - a2|contains: ['google.com', 'microsoft.com', 'apple.com', 'amazonaws.com']
    - a3|contains: ['google.com', 'microsoft.com', 'apple.com', 'amazonaws.com']
    - a4|contains: ['google.com', 'microsoft.com', 'apple.com', 'amazonaws.com']

  condition: selection_tool and selection_override_flag and selection_trusted_domain_spoofed

falsepositives:
  - Legitimate testing/debugging of DNS overrides or CDN endpoint pinning against real trusted domains by developers; auditd cannot inspect the actual wire-level TLS handshake or certificate presented, so this remains only a coarse command-line proxy for deliberate service impersonation.

level: medium

title: "T1001.003 Data Obfuscation: Protocol or Service Impersonation"
id: 9ac1342c-faaf-4f70-95eb-2323581a7e22
description: 'Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessFilter, HeaderAnomalyScore.'
references:
  - https://attack.mitre.org/techniques/T1001/003
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.003

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    DestinationPort: 443
  selection_process:
    Image|endswith:
      - '/curl'
      - '/python3'
      - '/nc'
  filter_browser:
    Image|endswith:
      - '/Safari'
      - '/Google Chrome'
  condition: selection and selection_process and not filter_browser

falsepositives:
  - Command-line tools legitimately calling HTTPS APIs on port 443, since protocol header content used for impersonation detection is not exposed by unified log network fields.

level: medium

title: "T1001.003 Data Obfuscation: Protocol or Service Impersonation"
id: cf3115ec-ebfb-4f4c-ae8f-9a2678b75a83
description: 'Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TLSFingerprintMatch, AllowedServicePorts.'
references:
  - https://attack.mitre.org/techniques/T1001/003
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.003

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: 'Firewall'
  selection_port:
    Message|contains:
      - 'port 80'
      - 'port 443'

  condition: selection and selection_port

falsepositives:
  - ESXi cannot inspect TLS handshake fingerprints or validate protocol conformance at the host log level, so genuine management traffic on standard ports cannot be distinguished from impersonated protocol tunneling without a network sensor.

level: low

Related sub-techniques

• T1001.002 Steganography
• T1001.001 Junk Data

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1001.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan