M1031: Network Intrusion Prevention

Network Intrusion Prevention is a boundary control intended to block traffic that matches intrusion detection signatures. Its business value is strongest where adversary behavior depends on network communications: command-and-control, proxying, protocol impersonation, service discovery, and multiple exfiltration patterns. For leaders, the key question is not whether an IPS exists, but whether it is positioned, tuned, and governed to block the specific network behaviors that matter to the organization without disrupting legitimate operations.

Executive priority

Prioritize this mitigation as part of resilience and incident containment planning for command-and-control and exfiltration risk. The related ATT&CK techniques show coverage relevance across C2 channels, alternate protocols, DNS/web/file/mail protocols, proxies, scheduled or size-limited transfers, and service discovery. Executives should ask for evidence of where blocking is enforced, how signatures are maintained, what traffic is not inspected, and how exceptions are approved. This is also useful compliance evidence when demonstrating preventive network controls, but it should not be treated as complete coverage by itself.

Technical view

MITRE defines M1031 as using intrusion detection signatures to block traffic at network boundaries. SOC and detection engineering teams should validate IPS policy coverage against the related techniques: Data Obfuscation, Junk Data, Steganography, Protocol or Service Impersonation, Fallback Channels, Scheduled Transfer, Data Transfer Size Limits, Exfiltration over C2 or alternative protocols, Application Layer Protocol abuse, Proxy behavior, Non-Application Layer Protocol C2, Web Service C2, and Network Service Discovery. Because no official detection text is provided for this mitigation, validation should focus on control placement, signature relevance, alert-to-block behavior, exception handling, and whether encrypted, obfuscated, internal, cloud, or non-standard protocol traffic creates blind spots.

Likely telemetry

IPS/IDS alerts and block events at network boundaries
Firewall allow/deny logs correlated with IPS decisions
Network flow records showing source, destination, port, protocol, volume, and timing
DNS query and response logs where DNS-based C2 or exfiltration is in scope
Web proxy or secure web gateway logs for HTTP/S and web service traffic

Detection direction

Confirm which related ATT&CK techniques have active signatures or blocking rules and which are only monitored.
Validate that IPS placement covers relevant ingress, egress, and segmented boundary paths; network boundaries may not include all internal or cloud traffic.
Tune for protocol impersonation, junk data, abnormal transfer sizing, scheduled transfers, proxy behavior, and non-standard protocol use without assuming every anomaly is malicious.
Review false positives carefully for common protocols such as HTTP/S, DNS, mail, SMB, FTP, and publish/subscribe protocols because legitimate business traffic may look similar at a network level.
Identify blind spots where encryption, steganography, legitimate web services, fallback channels, or approved proxies reduce signature visibility.

Mitigation priorities

Start with an inventory of network boundaries where IPS blocking is expected, including internet egress, ingress, sensitive segment boundaries, and cloud/IaaS paths where applicable to the environment.
Map IPS signatures and policies to the related C2, discovery, and exfiltration techniques to expose unsupported or monitor-only areas.
Maintain a governed signature update and exception process so blocking remains current while business-critical traffic is not disrupted unexpectedly.
Prioritize egress controls and protocol governance for commonly abused channels such as web, DNS, file transfer, mail, and proxy paths.
Use IPS blocking as one layer alongside logging, segmentation, firewall policy, proxy controls, and incident response playbooks; do not rely on signatures alone for obfuscated or encrypted traffic.

Additional notes and limits

The object is a mitigation, not a detection analytic. Its official description is brief, and no official detection guidance is provided. The relationship set is important: MITRE links this mitigation to many command-and-control and exfiltration techniques, plus network service discovery, which makes it most useful as a preventive network-control discussion rather than a standalone SOC alerting strategy.

Platforms and tactics are not specified on the mitigation object itself. Platform references come from related techniques and should be validated against the local environment before drawing coverage conclusions. The supplied data does not prove any organization has effective IPS coverage, active exploitation, specific adversary use, or guaranteed detection/blocking.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques59 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1568	Dynamic Resolution	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Malware researchers can reverse engineer malware variants that use dynamic resolution and determine future C2 infrastructure that the malware will attempt to contact, but this is a time and resource intensive effort.[1][2]
Enterprise	T1542.005	TFTP BootSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific protocols, such as TFTP, can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific technique used by a particular adversary or tool, and will likely be different across various network configurations.
Enterprise	T1008	Fallback Channels	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [3]
Enterprise	T1572	Protocol Tunneling	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1071	Application Layer Protocol	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1048.003	Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Enterprise	T1105	Ingress Tool Transfer	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.[3]
Enterprise	T1132	Data Encoding	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [3]
Enterprise	T1568.002	Domain Generation AlgorithmsSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Malware researchers can reverse engineer malware variants that use DGAs and determine future domains that the malware will attempt to contact, but this is a time and resource intensive effort.[1][2] Malware is also increasingly incorporating seed values that can be unique for each instance, which would then need to be determined to extract future generated domains. In some cases, the seed that a particular sample uses can be extracted from DNS traffic.[4] Even so, there can be thousands of possible domains generated per day; this makes it impractical for defenders to preemptively register all possible C2 domains due to the cost.
Enterprise	T1102	Web Service	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1041	Exfiltration Over C2 Channel	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. [3]
Enterprise	T1104	Multi-Stage Channels	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1090.002	External ProxySub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.[3]
Enterprise	T1095	Non-Application Layer Protocol	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1204.005	Malicious LibrarySub-technique	Network prevention intrusion systems and systems designed to scan and remove malicious downloads can be used to block activity.
Enterprise	T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Enterprise	T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 ProtocolSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Enterprise	T1557.002	ARP Cache PoisoningSub-technique	Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
Enterprise	T1573.001	Symmetric CryptographySub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1046	Network Service Discovery	Use network intrusion detection/prevention systems to detect and prevent remote service scans.
Enterprise	T1557.001	Name Resolution Poisoning and SMB RelaySub-technique	Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
Enterprise	T1570	Lateral Tool Transfer	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. [3]
Enterprise	T1557.004	Evil TwinSub-technique	Wireless intrusion prevention systems (WIPS) can identify traffic patterns indicative of adversary-in-the-middle activity and scan for evils twins and rogue access points.
Enterprise	T1204.001	Malicious LinkSub-technique	If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
Enterprise	T1566	Phishing	Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.
Enterprise	T1071.003	Mail ProtocolsSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1204.004	Malicious Copy and PasteSub-technique	If a link is being requested by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
Enterprise	T1557.003	DHCP SpoofingSub-technique	Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.[5]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.
Enterprise	T1048	Exfiltration Over Alternative Protocol	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Enterprise	T1204.003	Malicious ImageSub-technique	Network prevention intrusion systems and systems designed to scan and remove malicious downloads can be used to block activity.
Enterprise	T1001.001	Junk DataSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.
Enterprise	T1001	Data Obfuscation	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.
Enterprise	T1090.001	Internal ProxySub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.[3]
Enterprise	T1204	User Execution	If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
Enterprise	T1557	Adversary-in-the-Middle	Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
Enterprise	T1602.002	Network Device Configuration DumpSub-technique	Configure intrusion prevention devices to detect SNMP queries and commands from unauthorized sources. Create signatures to detect Smart Install (SMI) usage from sources other than trusted director.[6]
Enterprise	T1602.001	SNMP (MIB Dump)Sub-technique	Configure intrusion prevention devices to detect SNMP queries and commands from unauthorized sources.[7]
Enterprise	T1029	Scheduled Transfer	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. [3]
Enterprise	T1102.001	Dead Drop ResolverSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1030	Data Transfer Size Limits	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Enterprise	T1221	Template Injection	Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.[8]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1071.002	File Transfer ProtocolsSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1071.001	Web ProtocolsSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1573	Encrypted Channel	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1001.002	SteganographySub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.
Enterprise	T1602	Data from Configuration Repository	Configure intrusion prevention devices to detect SNMP queries and commands from unauthorized sources.[7]
Enterprise	T1001.003	Protocol or Service ImpersonationSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.
Enterprise	T1071.004	DNSSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1102.003	One-Way CommunicationSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1090	Proxy	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [3]
Enterprise	T1219	Remote Access Tools	Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.
Enterprise	T1542.004	ROMMONkitSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific protocols, such as TFTP, can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific technique used by a particular adversary or tool, and will likely be different across various network configurations.
Enterprise	T1571	Non-Standard Port	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1071.005	Publish/Subscribe ProtocolsSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Enterprise	T1132.001	Standard EncodingSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.
Enterprise	T1132.002	Non-Standard EncodingSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.
Enterprise	T1102.002	Bidirectional CommunicationSub-technique	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.0
Created: Jun 10, 2019, 20:46 UTC (UTC+00:00)
Modified: Oct 17, 2024, 18:54 UTC (UTC+00:00)
Raw hash: f72541d59fa3e656...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Oct 17, 2024, 18:54 UTC (UTC+00:00)	Current bundle	`f72541d59fa3…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Cybereason Dissecting DGAs
Sternfeld, U. (2016). Dissecting Domain Generation Algorithms: Eight Real World DGA Variants. Retrieved February 18, 2019.
[2]
Cisco Umbrella DGA Brute Force
Kasza, A. (2015, February 18). Using Algorithms to Brute Force Algorithms. Retrieved February 18, 2019.
Open source URL
[3]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[4]
Akamai DGA Mitigation
Liu, H. and Yuzifovich, Y. (2018, January 9). A Death Match of Domain Generation Algorithms. Retrieved February 18, 2019.
Open source URL
[5]
dhcp_serv_op_events
Microsoft. (2006, August 31). DHCP Server Operational Events. Retrieved March 7, 2022.
Open source URL
[6]
US-CERT TA18-106A Network Infrastructure Devices 2018
US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL
[7]
US-CERT-TA18-106A
US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL
[8]
Anomali Template Injection MAR 2018
Intel_Acquisition_Team. (2018, March 1). Credential Harvesting and Malicious File Delivery using Microsoft Office Template Injection. Retrieved July 20, 2018.
Open source URL
[9]
mitre-attackM1031
Open source URL
[10]
mitre-attackM1031
Open source URL
[11]
mitre-attackM1031
Open source URL
[12]
Cisco Umbrella DGA Brute Force
Kasza, A. (2015, February 18). Using Algorithms to Brute Force Algorithms. Retrieved February 18, 2019.
Open source URL
[13]
Cybereason Dissecting DGAs
Sternfeld, U. (2016). Dissecting Domain Generation Algorithms: Eight Real World DGA Variants. Retrieved February 18, 2019.
[14]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[15]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[16]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[17]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[18]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[19]
Akamai DGA Mitigation
Liu, H. and Yuzifovich, Y. (2018, January 9). A Death Match of Domain Generation Algorithms. Retrieved February 18, 2019.
Open source URL
[20]
Cisco Umbrella DGA Brute Force
Kasza, A. (2015, February 18). Using Algorithms to Brute Force Algorithms. Retrieved February 18, 2019.
Open source URL
[21]
Cisco Umbrella DGA Brute Force
Kasza, A. (2015, February 18). Using Algorithms to Brute Force Algorithms. Retrieved February 18, 2019.
Open source URL
[22]
Cybereason Dissecting DGAs
Sternfeld, U. (2016). Dissecting Domain Generation Algorithms: Eight Real World DGA Variants. Retrieved February 18, 2019.
[23]
Cybereason Dissecting DGAs
Sternfeld, U. (2016). Dissecting Domain Generation Algorithms: Eight Real World DGA Variants. Retrieved February 18, 2019.
[24]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[25]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[26]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[27]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[28]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[29]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[30]
dhcp_serv_op_events
Microsoft. (2006, August 31). DHCP Server Operational Events. Retrieved March 7, 2022.
Open source URL
[31]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[32]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[33]
US-CERT TA18-106A Network Infrastructure Devices 2018
US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL
[34]
US-CERT-TA18-106A
US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL
[35]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[36]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[37]
Anomali Template Injection MAR 2018
Intel_Acquisition_Team. (2018, March 1). Credential Harvesting and Malicious File Delivery using Microsoft Office Template Injection. Retrieved July 20, 2018.
Open source URL
[38]
US-CERT-TA18-106A
US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL
[39]
US-CERT-TA18-106A
US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL
[40]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL
[41]
University of Birmingham C2
Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use