T1095 — Non-Application Layer Protocol

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol…

Sigma detection rules (5)

T1095 Non-Application Layer Protocol

title: T1095 Non-Application Layer Protocol
id: 99f9dc71-f509-4585-9f5c-4d0ffba9f7a6
description: 'Detects known ICMP-tunneling/raw-socket C2 tools since Sysmon only records TCP/UDP. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ProcessContextAllowList, ByteTransferAnomalyThreshold, ProtocolUsageBaseline.'
references:
  - https://attack.mitre.org/techniques/T1095
author: Shahrukh Khan
date: 2026-05-04
license: MIT
tags:
  - attack.command-and-control
  - attack.t1095

logsource:
  category: process_creation
  product: windows

detection:
  selection_icmpsh:
    CommandLine|contains: 'icmpsh'
  selection_ptunnel:
    Image|endswith: '\ptunnel.exe'
  selection_hans:
    Image|endswith: '\hans.exe'
  selection_nping_icmp:
    Image|endswith: '\nping.exe'
    CommandLine|contains: '--icmp'
  condition: 1 of selection_*

falsepositives:
  - Legitimate network diagnostic use of nping/ptunnel.

level: medium

T1095 Non-Application Layer Protocol

title: T1095 Non-Application Layer Protocol
id: c1a31704-3505-42e0-b0f3-72422d65c87b
description: 'Detection of Non-Application Layer Protocols for C2. (Retargeted to the network_connection auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RawSocketExecutionPath, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1095
author: Shahrukh Khan
date: 2026-01-06
license: MIT
tags:
  - attack.command-and-control
  - attack.t1095

logsource:
  category: network_connection
  product: linux

detection:
  selection:
    type: SYSCALL
    syscall: socket
    a0: '2'
    a1: '3'
  selection_tools:
    type: EXECVE
    a0|endswith:
      - '/hping3'
      - '/nc'
    a1|contains: '-u'

  condition: 1 of selection*

falsepositives:
  - Raw socket creation (SOCK_RAW, a1=3) is used by legitimate network diagnostic tools (ping, traceroute) run as root; scope to unexpected binaries rather than standard ICMP utilities.

level: medium

T1095 Non-Application Layer Protocol

title: T1095 Non-Application Layer Protocol
id: 730b906b-6db6-4038-b851-30f1b9a47ff6
description: 'Detection of Non-Application Layer Protocols for C2. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UnsignedBinaryNetworkUsage.'
references:
  - https://attack.mitre.org/techniques/T1095
author: Shahrukh Khan
date: 2026-06-22
license: MIT
tags:
  - attack.command-and-control
  - attack.t1095

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/nc'
      - '/ncat'
    DestinationPort:
      - 1234
      - 4444
      - 31337

  condition: selection

falsepositives:
  - Network administrators using nc for legitimate raw socket testing on common ephemeral ports.

level: medium

T1095 Non-Application Layer Protocol

title: T1095 Non-Application Layer Protocol
id: 1b7f1fae-3960-47ca-8087-354ecf5a3223
description: 'Detection of Non-Application Layer Protocols for C2. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: ProtocolEntropyThreshold, SessionDurationThreshold.'
references:
  - https://attack.mitre.org/techniques/T1095
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1095

logsource:
  product: nsm
  service: firewall

detection:
  selection_unknown_app:
    app|contains:
      - 'unknown-tcp'
      - 'unknown-udp'
      - 'not-applicable'
  selection_allow:
    action: 'allow'
  condition: selection_unknown_app and selection_allow

falsepositives:
  - Proprietary internal applications and custom protocols not yet fingerprinted by the firewalls App-ID equivalent commonly appear as unknown traffic.

level: medium

T1095 Non-Application Layer Protocol

title: T1095 Non-Application Layer Protocol
id: 636c3076-c341-4917-b163-8d0e744554ec
description: 'Detection of Non-Application Layer Protocols for C2. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VMCIBackdoorProcess, GuestToHostCommPattern.'
references:
  - https://attack.mitre.org/techniques/T1095
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.command-and-control
  - attack.t1095

logsource:
  product: esxi
  service: vmkernel

detection:
  selection:
    Message|contains: 'VMCI'
  selection_conn:
    Message|contains:
      - 'backdoor'
      - 'guest'

  condition: selection and selection_conn

falsepositives:
  - Legitimate VMware Tools and guest-host communication over the VMCI backdoor channel occurs constantly for normal VM management, so this indicator has very high natural noise.

level: low

Explore