Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1071.001: Web Protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as HTTP/S[1] and WebSocket[2] that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

EnterpriseT1071.001Sub-techniqueObject v1.5 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Web Protocols (T1071.001) matters because command-and-control can hide inside traffic every organization must allow: HTTP, HTTPS, and WebSockets. For leaders, the issue is not whether web traffic exists, but whether the organization can distinguish normal business web use from remote control traffic across Windows, Linux, macOS, ESXi, and network devices.

Executive priority

Prioritize this as a resilience and visibility question: do network boundaries, endpoints, and SOC processes provide usable evidence for suspicious web-based command-and-control, including encrypted or high-volume web traffic? The relationship set shows this technique appearing across many reported campaigns, including espionage, ransomware, supply-chain, government, energy, critical infrastructure, MSP/ISP, and network-device-focused activity, so coverage should be treated as a core control-validation item rather than a niche malware signature problem.

Technical view

ATT&CK provides no official detection text for this sub-technique, but it is associated with detection strategy DET0027: Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets. SOC and detection teams should validate visibility into outbound and lateral web traffic, especially unusual HTTP/S or WebSocket sessions, uncommon destinations, abnormal request patterns, suspicious headers or user-agent behavior where visible, and endpoint processes initiating web connections inconsistent with their role. Because this is a sub-technique of Application Layer Protocol under command-and-control, detection should focus on behavior and context rather than assuming web ports or TLS imply benign traffic.

Likely telemetry

  • Proxy and secure web gateway logs for HTTP, HTTPS, and WebSocket traffic
  • Firewall, egress, ingress, and lateral traffic logs
  • Network IDS/IPS alerts and signature matches at network boundaries
  • Network flow metadata such as source, destination, ports, timing, volume, and session duration
  • HTTP metadata where available, including host, URI, method, headers, and user-agent fields

Detection direction

  • Map current detections to DET0027 and confirm they cover HTTP, HTTPS, and WebSocket-based command-and-control patterns, not only cleartext HTTP.
  • Baseline expected web traffic by server role, workstation group, network device, and administrative function so anomalous destinations, timing, volume, or client behavior can be reviewed in context.
  • Tune carefully for false positives from legitimate web applications, software updates, APIs, collaboration tools, and administrative platforms that may use persistent HTTPS or WebSocket sessions.
  • Pay special attention to blind spots created by encrypted HTTPS, unmanaged endpoints, network devices with limited logging, ESXi management paths, and traffic that bypasses proxies or inspection points.
  • Use relationship context from campaigns involving exposed servers, network devices, MSP/ISP environments, supply chain activity, ransomware intrusion, and critical infrastructure to guide tabletop scenarios and threat hunting priorities without assuming local exposure.

Mitigation priorities

  • Implement M1037 Filter Network Traffic by enforcing ingress, egress, and lateral traffic rules based on authorized business needs.
  • Use M1031 Network Intrusion Prevention with intrusion detection/prevention signatures at network boundaries, recognizing that signatures should supplement—not replace—behavioral monitoring.
  • Restrict public-facing server access to authorized sources where applicable, consistent with the supplied mitigation guidance.
  • Review which systems are allowed to initiate outbound web traffic directly, especially servers, ESXi hosts, network devices, and administrative infrastructure.
  • Ensure filtering and monitoring policies produce audit-ready evidence showing what web traffic is allowed, blocked, inspected, or logged.
Analyst notes and limits

The supplied object identifies web protocols as a command-and-control sub-technique and lists HTTP/S and WebSocket as examples. The many campaign relationships make this strategically important, but they do not prove current activity against any specific organization. Use them to justify control validation, hunting hypotheses, and IR readiness exercises rather than attribution conclusions.

MITRE did not provide official detection text for this object, and the related detection strategy is named but not described in detail here. Local architecture, encryption policy, proxy coverage, endpoint telemetry, and allowed-business-traffic baselines are required to determine actual detection coverage and control effectiveness.

Official MITRE ATT&CK definition

Web Protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Protocols such as HTTP/S[1] and WebSocket[2] that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0075: Rancor

Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents. [1]

Group Enterprise

G1013: Metador

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.[1]

Group Enterprise

G1042: RedEcho

RedEcho is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. RedEcho overlaps with various other PRC-linked threat groups, such as APT41, and is linked to ShadowPad malware use through shared infrastructure.[1][2]

Group Enterprise

G1002: BITTER

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.[1][2]

Group Enterprise

G1036: Moonstone Sleet

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.[1]

Group Enterprise

G0049: OilRig

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]

Group Enterprise

G0071: Orangeworm

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.[1] Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.[2]

Group Enterprise

G0067: APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Group Enterprise

G1035: Winter Vivern

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.[1][2][3][4][5]

Group Enterprise

G1034: Daggerfly

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.[1][2][3][4]

Group Enterprise

G0059: Magic Hound

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]

Malware Enterprise

S0495: RDAT

RDAT is a backdoor used by the suspected Iranian threat group OilRig. RDAT was originally identified in 2017 and targeted companies in the telecommunications sector.[1]

Windows
Malware Enterprise

S1108: PULSECHECK

PULSECHECK is a web shell written in Perl that was used by APT5 as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) companies.[1]

Network DevicesLinux
Malware Enterprise

S0144: ChChes

ChChes is a Trojan that appears to be used exclusively by menuPass. It was used to target Japanese organizations in 2016. Its lack of persistence methods suggests it may be intended as a first-stage tool. [1] [2] [3]

Windows
Malware Enterprise

S1246: BeaverTail

BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview. BeaverTail has been delivered to victims through code repository sites and has been embedded within malicious attachments.[1][2][3][4]

LinuxmacOSWindows
Malware Enterprise

S1023: CreepyDrive

CreepyDrive is a custom implant has been used by POLONIUM since at least early 2022 for C2 with and exfiltration to actor-controlled OneDrive accounts.[1]

POLONIUM has used a similar implant called CreepyBox that relies on actor-controlled DropBox accounts.[1]

WindowsOffice Suite
Malware Enterprise

S0341: Xbash

Xbash is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks. Xbash was developed in Python and then converted into a self-contained Linux ELF executable by using PyInstaller.[1]

WindowsLinux
Relationship explorer

All related ATT&CK context

uses · Malware S1047: Mori Enterprise uses · Malware S0275: UPPERCUT Enterprise uses · Malware S0495: RDAT Enterprise uses · Malware S1108: PULSECHECK Enterprise uses · Malware S0207: Vasport Enterprise uses · Malware S0502: Drovorub Enterprise uses · Malware S0144: ChChes Enterprise uses · Malware S1246: BeaverTail Enterprise uses · Malware S1023: CreepyDrive Enterprise uses · Malware S0091: Epic Enterprise uses · Malware S1026: Mongall Enterprise uses · Malware S0341: Xbash Enterprise uses · Malware S0578: SUPERNOVA Enterprise uses · Malware S1119: LIGHTWIRE Enterprise uses · Malware S0653: xCaon Enterprise uses · Group G0075: Rancor Enterprise uses · Malware S1051: KEYPLUG Enterprise uses · Malware S0269: QUADAGENT Enterprise uses · Group G1013: Metador Enterprise uses · Malware S0599: Kinsing Enterprise uses · Campaign C0047: RedDelta Modified PlugX Infection Chain Operations Enterprise uses · Group G1042: RedEcho Enterprise uses · Malware S0128: BADNEWS Enterprise uses · Group G1002: BITTER Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.5
Created
Modified
Raw hash
3ec95b2fcc943c75...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.5 Current bundle 3ec95b2fcc94…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CrowdStrike Putter Panda

    Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.

    Open source URL
  2. [2]
    Brazking-Websockets

    Shahar Tavor. (n.d.). BrazKing Android Malware Upgraded and Targeting Brazilian Banks. Retrieved March 24, 2023.

    Open source URL
  3. [3]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  4. [4]
    mitre-attack T1071.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use