T1071.005 — Publish/Subscribe Protocols

Tactic: Command and Control · Platforms: macOS, Linux, Windows, Network Devices

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the…

Sub-technique of Application Layer Protocol (T1071).

Sigma detection rules (4)

title: "T1071.005 Application Layer Protocol: Publish/Subscribe Protocols"
id: 6616303b-9e2c-4dd7-b5d5-f69aedba89cf
description: 'Detects outbound network connections to standard publish/subscribe broker ports (MQTT 1883/8883, AMQP 5672/5671, XMPP 5222/5223, STOMP 61613/61614), consistent with using a pub/sub protocol to blend C2 traffic in with legitimate messaging infrastructure. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: UnusualProcessList, TimeWindow, ProtocolPortList.'
references:
  - https://attack.mitre.org/techniques/T1071/005
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.005

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'
    DestinationPort:
      - 1883
      - 8883
      - 5672
      - 5671
      - 5222
      - 5223
      - 61613
      - 61614

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate IoT/messaging middleware, chat, or telemetry applications that use MQTT/AMQP/XMPP/STOMP for approved business purposes; System and service accounts are excluded via filter_system_account; tune further with process/path allowlists (UnusualProcessList) if noise remains.

level: medium

title: "T1071.005 Application Layer Protocol: Publish/Subscribe Protocols"
id: cd4d884b-686f-427c-a70c-4ef09bd49be8
description: 'Behavioral Detection of Publish/Subscribe Protocol Misuse for C2, covering MQTT, AMQP, and XMPP CLI clients, plus a companion network-connection rule for default pub/sub broker ports to catch library-based (non-CLI) usage. (Retargeted to the process_creation auditd telemetry that actually captures CLI-based use of this technique; see logsource below.) Tune using: BrokerAllowList, TopicAnomalyScore.'
references:
  - https://attack.mitre.org/techniques/T1071/005
author: Shahrukh Khan
date: 2026-05-21
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.005

logsource:
  category: process_creation
  product: linux

detection:
  selection_mqtt:
    type: EXECVE
    a0|endswith:
      - '/mosquitto_pub'
      - '/mosquitto_sub'
      - '/mosquitto_rr'
      - '/paho_pub'
      - '/paho_sub'
  selection_amqp:
    type: EXECVE
    a0|endswith:
      - '/amqp-publish'
      - '/amqp-consume'
      - '/amqp-declare-queue'
      - '/rabbitmqadmin'
  selection_stomp:
    type: EXECVE
    a0|endswith:
      - '/stomp'
      - '/stomp-cli'
  selection_xmpp:
    type: EXECVE
    a0|endswith:
      - '/sendxmpp'
      - '/xmppc'
      - '/profanity'

  condition: 1 of selection_*

falsepositives:
  - MQTT/AMQP/STOMP/XMPP pub/sub clients are legitimately used in IoT/telemetry/messaging pipelines; topic/broker anomaly scoring referenced in tuning fields is not derivable from auditd process-creation alone. This variant still only sees CLI tool invocation - malware linking a pub/sub client library directly (no subprocess exec) requires the companion network_connection rule below.

level: low
---
title: "T1071.005 Application Layer Protocol: Publish/Subscribe Protocols - Library-based Network Connections"
id: e3a9f271-4b3c-4d8e-9a1f-6c72d1e4a9b1
description: 'Companion to cd4d884b-686f-427c-a70c-4ef09bd49be8: detects outbound connections to default pub/sub broker ports (MQTT/MQTTS, AMQP/AMQPS, STOMP, XMPP) to catch malware that links a pub/sub client library directly instead of shelling out to a CLI tool, which the process_creation-only base rule cannot see.'
references:
  - https://attack.mitre.org/techniques/T1071/005
author: Shahrukh Khan
date: 2026-05-21
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.005

logsource:
  category: network_connection
  product: linux

detection:
  selection:
    dst_port:
      - 1883
      - 8883
      - 5672
      - 5671
      - 61613
      - 61614
      - 5222
      - 5269

  condition: selection

falsepositives:
  - Legitimate IoT telemetry, message brokers (Mosquitto, RabbitMQ, ActiveMQ), and XMPP chat servers/clients on these default ports; scope to hosts that should never speak these protocols or add a broker/destination allow-list.

level: informational

title: "T1071.005 Application Layer Protocol: Publish/Subscribe Protocols"
id: 9374cea4-443a-45e5-8cf5-412a96942aa4
description: 'Behavioral Detection of Publish/Subscribe Protocol Misuse for C2. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AppContextFilter, URIPathRegex.'
references:
  - https://attack.mitre.org/techniques/T1071/005
author: Shahrukh Khan
date: 2026-06-19
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|contains:
      - 'mosquitto_pub'
      - 'mosquitto_sub'
      - 'paho'
      - 'mqtt://'

  condition: selection

falsepositives:
  - IoT development and testing tools on developer workstations legitimately use MQTT publish or subscribe clients.

level: medium

title: "T1071.005 Application Layer Protocol: Publish/Subscribe Protocols"
id: 049f43fd-8fff-4bee-bb5f-10f7672726ae
description: 'Behavioral Detection of Publish/Subscribe Protocol Misuse for C2. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: BrokerReputationList, PayloadLengthThreshold.'
references:
  - https://attack.mitre.org/techniques/T1071/005
author: Shahrukh Khan
date: 2026-05-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1071.005

logsource:
  product: nsm
  service: flow

detection:
  selection_service:
    service:
      - 'mqtt'
      - 'irc'
  selection_beacon:
    duration|gte: 300
    orig_bytes|lte: 512
  condition: selection_service and selection_beacon

falsepositives:
  - Legitimate IoT telemetry devices or chat clients using MQTT or IRC for business purposes can produce long-lived, low-volume sessions that match this pattern.

level: medium

Related sub-techniques

• T1071.002 File Transfer Protocols
• T1071.004 DNS
• T1071.003 Mail Protocols
• T1071.001 Web Protocols

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1071.005 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan