T1071.001 — Web Protocols

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the…

Sub-technique of Application Layer Protocol (T1071).

Sigma detection rules (5)

title: "T1071.001 Application Layer Protocol: Web Protocols"
id: 6a196bf4-abb7-4965-9333-2f425f58fb07
description: 'Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: ProcessNameExclusions, UserAgentAnomalies, OutboundByteRatioThreshold.'
references:
  - https://attack.mitre.org/techniques/T1071/001
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 3
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not 1 of filter_*

falsepositives:
  - Legitimate non-browser applications (update services, package managers, backup/sync agents, custom in-house tools) that communicate directly over HTTP/S on common web ports rather than through a browser; system and service accounts are excluded via filter_system_account. Tune further with process/path allowlists if noise remains.

level: medium

title: "T1071.001 Application Layer Protocol: Web Protocols"
id: e92b86aa-f8cb-4ccf-afdd-b99ab9f9bd97
description: 'Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets via curl/wget calls to bare-IP destinations, excluding RFC1918/loopback/link-local ranges, plus curl/wget invocations carrying spoofed User-Agent/header arguments. Paired with a companion correlation rule that flags repeated calls to the same destination within a short window as a beaconing-interval proxy. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLinePatternMatch, BeaconIntervalWindow.'
references:
  - https://attack.mitre.org/techniques/T1071/001
author: Shahrukh Khan
date: 2026-03-06
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_ip:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
    a1|re: '^https?://(?!(?:10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|169\.254\.))\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
  selection_ua:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
    a1|contains:
      - '-A'
      - '--user-agent'
      - '-H'
    a2|contains:
      - 'Mozilla'
      - 'Chrome'
      - 'Referer:'
      - 'Cookie:'

  condition: selection_ip or selection_ua

falsepositives:
  - Internal monitoring/health-check scripts that address services by raw IP are now excluded when the IP falls in RFC1918/loopback/link-local ranges; legitimate automation that deliberately sets a custom User-Agent/Referer/Cookie header (e.g. API clients) can still trigger selection_ua.

level: medium
---
title: "T1071.001 Application Layer Protocol: Web Protocols - Repeated Bare-IP Beaconing"
id: 3f6a1c2e-8b3d-4e1a-9f5c-2d7a6e9b1c40
description: 'Correlation companion for e92b86aa-f8cb-4ccf-afdd-b99ab9f9bd97: counts curl/wget invocations grouped by destination argument within a 10-minute window, approximating regular beaconing-interval C2 check-ins.'
status: experimental
correlation:
  type: event_count
  rules:
    - e92b86aa-f8cb-4ccf-afdd-b99ab9f9bd97
  group-by:
    - a1
  timespan: 10m
  condition:
    gte: 5
level: medium

title: "T1071.001 Application Layer Protocol: Web Protocols"
id: fa01f9c2-44cc-4ee9-8d32-9990b2945fb9
description: 'Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SuspiciousParentProcess, URIEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1071/001
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains:
      - '/Microsoft Word'
      - '/Microsoft Excel'
      - '/Preview.app'
    Image|endswith:
      - '/curl'
      - '/osascript'
      - '/python3'

  condition: selection

falsepositives:
  - Managed environments with approved macro-enabled document workflows that call curl for legitimate update checks are rare but possible.

level: high

title: "T1071.001 Application Layer Protocol: Web Protocols"
id: 695a9a19-1999-4867-8aa1-7a7176ee4896
description: 'Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: HeaderEncodingPattern, TLSFingerprintMismatch.'
references:
  - https://attack.mitre.org/techniques/T1071/001
author: Shahrukh Khan
date: 2026-06-04
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.001

logsource:
  product: nsm
  service: flow

detection:
  selection_browser_ua:
    user_agent|contains: 'Mozilla/5.0'
  selection_nonbrowser_ja3:
    ja3|contains: '72a589da586844d7f0818ce684948eea'
  condition: selection_browser_ua and selection_nonbrowser_ja3

falsepositives:
  - Legitimate thin HTTP clients or automation frameworks that spoof a common browser user agent string while using a distinct TLS stack can also match.

level: high

title: "T1071.001 Application Layer Protocol: Web Protocols"
id: 9ac6ce1c-b435-4c35-99de-35ba8c5d63db
description: 'Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ShellScriptMatch, ExternalConnectionFilter.'
references:
  - https://attack.mitre.org/techniques/T1071/001
author: Shahrukh Khan
date: 2026-01-18
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.001

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: 'Firewall'
  selection_web:
    Message|contains|all:
      - 'ruleset'
      - 'httpClient'

  condition: selection and selection_web

falsepositives:
  - ESXi cannot inspect HTTP or HTTPS payload content at the host log level, so genuine web-based command and control cannot be distinguished from legitimate outbound update or plugin traffic without a network sensor.

level: low

Related sub-techniques

• T1071.002 File Transfer Protocols
• T1071.004 DNS
• T1071.003 Mail Protocols
• T1071.005 Publish/Subscribe Protocols

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1071.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan