T1001.003: Protocol or Service Impersonation
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.
Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.[1][2]
Analyst context for executives and security teams
Protocol or Service Impersonation matters because command-and-control traffic may look enough like normal web or service traffic to avoid quick triage and some network controls. The business risk is not the protocol itself; it is false confidence that “HTTPS-looking” or familiar-service-looking traffic is benign. For leaders, this is a test of whether network monitoring can distinguish legitimate business use from C2 that manipulates TLS handshakes, HTTP headers, URI paths, certificates, ports, or payload structure to blend in.
Executive priority
Prioritize this where outbound network visibility is a dependency for incident detection, compliance evidence, or response scoping across ESXi, Linux, macOS, and Windows environments. Ask whether security teams can show evidence of anomalous TLS, HTTP header, and port/protocol mismatch detection, not just firewall allow/deny logs. Because ATT&CK links this behavior to multiple malware families, tools, groups, and campaign reporting, it should be treated as a material C2 evasion scenario for managed detection, IR readiness, and network control validation; however, local exposure depends on your actual traffic, inspection points, and logging coverage.
Technical view
This is an enterprise command-and-control sub-technique of Data Obfuscation. ATT&CK does not provide an official detection paragraph, but the related detection strategy DET0470 points defenders toward correlating anomalous TLS, HTTP headers, and port mismatches. SOC and detection teams should validate whether network controls can identify fake or abnormal SSL/TLS handshakes, unexpected certificate/service characteristics, manipulated HTTP headers, unusual URI endpoints, and web traffic that claims to be a trusted service while not matching expected protocol behavior. IR teams should preserve enough network evidence to compare claimed service identity against observed headers, certificates, ports, and transmitted data patterns.
Likely telemetry
- Network intrusion detection/prevention alerts at network boundaries
- HTTP request and response metadata, including headers and URI endpoints
- TLS/SSL handshake metadata and certificate observations
- Port, protocol, and service correlation data for outbound sessions
- Network flow/session metadata showing destinations, timing, and volume
Detection direction
- Validate DET0470-style correlation: anomalous TLS behavior plus HTTP header inconsistencies plus port/protocol mismatch, rather than relying on any single indicator.
- Tune detections against known-good business web and service traffic so unusual but approved applications do not create excessive false positives.
- Look for traffic that presents as SSL/TLS or a trusted web service but has inconsistent handshake, certificate, header, URI, or transmitted-data characteristics.
- Confirm inspection points can see the relevant metadata; tools that only record destination and port may miss the impersonation behavior.
- Use relationship context from associated software and campaigns as threat-intelligence enrichment, not as proof of activity in the local environment.
Mitigation priorities
- Use Network Intrusion Prevention as identified by ATT&CK mitigation M1031, including intrusion detection signatures to block suspicious traffic at network boundaries.
- Prioritize visibility and control at outbound network choke points where C2 impersonation would need to pass.
- Maintain baselines of legitimate protocol and trusted-service usage so deviations in headers, TLS/certificate behavior, URI structure, and port use can be evaluated.
- Ensure incident response playbooks require collection of network metadata sufficient to validate whether traffic only appeared legitimate or actually matched expected service behavior.
Analyst notes and limits
ATT&CK describes adversaries disguising C2 by impersonating legitimate protocols or web services, including fake SSL/TLS handshakes and manipulation of HTTP headers, URI endpoints, SSL certificates, and transmitted data. The object is associated through ATT&CK relationships with DET0470, mitigation M1031, parent technique T1001 Data Obfuscation, campaign C0017, groups including Lazarus Group, Higaisa, and Mustang Panda, and multiple software entries including Cobalt Strike, SUNBURST, Okrum, and others. These relationships support defensive prioritization and enrichment, but not assumptions of current exploitation in any specific environment.
The official ATT&CK object provides no detection text, so detection guidance is based on the supplied DET0470 relationship and the technique description. No claim is made that any organization is exposed or that controls will guarantee detection. Local validation requires actual network architecture, logging depth, allowed-service inventory, and traffic baselines.
Protocol or Service Impersonation
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.
Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.[1][2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1001 | Data Obfuscation | This object subtechnique of Data Obfuscation. |
Groups, software, and campaigns
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
G0129: Mustang Panda
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]
G0126: Higaisa
Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.[1][2][3]
S1120: FRAMESTING
FRAMESTING is a Python web shell that was used during Cutting Edge to embed into an Ivanti Connect Secure Python package for command execution.[1]
S1227: StarProxy
StarProxy is custom malware used by Mustang Panda as a post-compromise tool, to enable proxying of traffic between the infected machine and other machines on the same network. [1]
S1228: PUBLOAD
PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.[1] PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.[2]
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
S0245: BADCALL
BADCALL is a Trojan malware variant used by the group Lazarus Group. [1]
S0387: KeyBoy
S0586: TAINTEDSCRIBE
TAINTEDSCRIBE is a fully-featured beaconing implant integrated with command modules used by Lazarus Group. It was first reported in May 2020.[1]
S0239: Bankshot
Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector. [1]
S0246: HARDRAIN
S0022: Uroburos
Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the Turla toolset to collect intelligence on sensitive targets worldwide. Uroburos has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. Uroburos is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. Uroburos has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.[1][2]
S0559: SUNBURST
S0260: InvisiMole
InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]
C0017: C0017
C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.1 | Current bundle | 0db68e9c3c8e… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
ESET Okrum July 2019
Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
Open source URL -
[2]
Malleable-C2-U42
Chris Navarrete Durgesh Sangvikar Andrew Guan Yu Fu Yanhui Jia Siddhart Shibiraj. (2022, March 16). Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect. Retrieved September 24, 2024.
Open source URL -
[3]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL -
[4]
mitre-attack T1001.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.