T1071: Application Layer Protocol
AI Answer
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring (Source: MITRE ATT&CK T1071)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1071 |
| Name | Application Layer Protocol |
| Tactic | Command and Control (command-and-control) |
| Platforms | Linux, macOS, Windows, Network Devices, ESXi |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Application Layer Protocol (T1071) is one of the highest-connectivity ATT&CK techniques: 16 MITRE STIX relationships reference this technique; 5 threat groups observed using it; 10 software families associated; 1 campaigns associated; 5 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1071). Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- Hildegard
- QUIETEXIT
- Raspberry Robin
- Siloscape
- Nightdoor
- NETEAGLE
- Lucifer
- Clambling
- Sliver
- Duqu
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- TeamTNT
- Rocke
- INC Ransom
- Velvet Ant
- Magic Hound
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- FrostyGoop Incident
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1071 Application Layer Protocol. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1071 Application Layer Protocol?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.