T1071.001: Web Protocols
AI Answer
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic (Source: MITRE ATT&CK T1071.001)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1071.001 |
| Name | Web Protocols |
| Tactic | Command and Control (command-and-control) |
| Platforms | ESXi, Linux, macOS, Network Devices, Windows |
| Sub-technique | Yes |
Why it matters
In the OpenTrojan knowledge graph, Web Protocols (T1071.001) is one of the highest-connectivity ATT&CK techniques: 422 MITRE STIX relationships reference this technique; 57 threat groups observed using it; 344 software families associated; 21 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1071/001). Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Detection
DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets AN0075 Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs. AN0076 Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains. AN0077 Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields). AN0078 Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget. AN0079 Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1071/001).
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- TrickBot
- BLINDINGCAN
- Ninja
- RCSession
- Spark
- QuietSieve
- BRICKSTORM
- Amadey
- NICECURL
- Proxysvc
- Torisma
- NOKKI
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- APT38
- BlackByte
- Kimsuky
- APT41
- APT32
- HAFNIUM
- MuddyWater
- RedEcho
- Gamaredon Group
- TeamTNT
- Sandworm Team
- APT18
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Operation Dream Job
- SharePoint ToolShell Exploitation
- Frankenstein
- RedDelta Modified PlugX Infection Chain Operations
- Operation MidnightEclipse
- 2015 Ukraine Electric Power Attack
- Indian Critical Infrastructure Intrusions
- 3CX Supply Chain Attack
- C0018
- C0021
- Juicy Mix
- SolarWinds Compromise
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1071.001 Web Protocols. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1071.001 Web Protocols?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.