Log in Request a demo

Attack technique

Application Layer Protocol

Application Layer Protocol is a technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS.

In short

Application Layer Protocol is a technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS. Because the traffic looks like normal traffic, it is harder to spot and block. MITRE tracks it as T1071 under the Command and Control tactic.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Command and Control · Step 13 Of 15 In The Attack Chain

  1. MITRE IDT1071ATT&CK technique
  2. Detection4ways to spot itBeacon-like timing · Detection strategy MITRE lists
  3. Defences2ways to stop itFilter network traffic

How it works

Attackers need a way to send instructions to a compromised system and get results back. With this technique they put those instructions and results inside a common protocol, so the traffic blends in with everything else on the network.

MITRE lists protocols used for web browsing, transferring files, electronic mail, DNS, and publishing or subscribing to messages. Inside a network, protocols such as SMB, SSH and RDP are commonly used between a proxy or pivot node and other nodes.

One sub-technique, T1071.004 DNS, covers abuse of DNS. MITRE notes that DNS packets have many fields and headers where data can be hidden, which is often known as DNS tunneling.

MITRE lists five sub-techniques: T1071.001 Web Protocols; T1071.002 File Transfer Protocols; T1071.003 Mail Protocols; T1071.004 DNS; T1071.005 Publish/Subscribe Protocols.

A real example

Procedure examples listed by MITRE ATT&CK:

  • Clambling can use Telnet for communication.
  • Hildegard has used an IRC channel for command and control.
  • Lucifer can use the Stratum protocol on port 10001 between the cryptojacking bot and the mining server.
  • Sliver can use the WireGuard VPN protocol for command and control.
  • Siloscape connects to an IRC server for command and control.

How to detect

  1. Unusual processes using common protocols

    Look for processes that make web, DNS or other application layer connections they would not normally make, especially with high outbound data volumes or irregular ports.

  2. Beacon-like timing

    Regular, repeated connections at fixed intervals, or unbalanced traffic where much more data leaves than arrives, can point to command and control.

  3. Tunnelling and misused protocols

    Watch for control traffic hidden in protocol headers, DNS over HTTPS, or SMB traffic crossing network segments where it does not belong.

  4. Detection strategy MITRE lists

    DET0444, Detection of Command and Control Over Application Layer Protocols.

How to defend

  1. Filter network traffic

    Use network appliances to filter inbound and outbound traffic by protocol, and set endpoint software to filter traffic too.

  2. Use network intrusion prevention

    Intrusion detection and prevention systems that use network signatures can identify traffic linked to known adversary malware and block it.

Questions

What is Application Layer Protocol (T1071)?

Application Layer Protocol is a Command and Control technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS. Because the traffic looks normal, it is harder to spot and block.

Which protocols do attackers hide control traffic in?

MITRE lists protocols used for web browsing, transferring files, electronic mail, DNS, and publishing or subscribing to messages. Inside a network, SMB, SSH and RDP are commonly used between a proxy or pivot node and other nodes.

What is DNS tunneling?

DNS tunneling is covered by sub-technique T1071.004. MITRE notes that DNS packets have many fields and headers where data can be hidden, so attackers can pass instructions and results inside DNS traffic.

How can I detect Application Layer Protocol abuse?

Look for processes that make web, DNS or other connections they would not normally make, especially with high outbound data volumes or irregular ports. Regular connections at fixed intervals, or traffic where much more data leaves than arrives, can point to command and control.

How do I defend against Application Layer Protocol abuse?

Use network appliances to filter inbound and outbound traffic by protocol, and set endpoint software to filter traffic too. Intrusion detection and prevention systems that use network signatures can identify traffic linked to known adversary malware and block it.

In our research

  1. ATT&CK techniques most used across threat groups October 2026
  2. WIRTE: Covert Espionage Actor Targeting the Middle East and Beyond July 2026
  3. WIRTE: Iran’s Covert Espionage Actor Targeting the Middle East and Beyond April 2026
  4. Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations March 2026
  5. OilRig: Iran’s Persistent Espionage Arm in Cyberspace December 2025
  6. Crafty Camel APT: Iran’s Expanding Espionage Footprint in the Modern Cyber Battlespace December 2025

Sources

  1. MITRE ATT&CK T1071: Application Layer Protocol MITRE
  2. MITRE ATT&CK T1071.004: DNS MITRE
  3. MITRE ATT&CK Tactic TA0011: Command and Control MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Read more

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more