Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and broker.
Protocols such as MQTT are widely used in Internet-of-Things (IoT) and operational technology environments where devices are resource constrained and there is limited or unreliable network bandwidth. The protocol follows a publish/subscribe design, with message distribution managed by a centralized broker. Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics. An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also blending in with normal, expected traffic.
| ID | Name | Description |
|---|---|---|
| S9046 | IOControl |
IOCONTROL connects to C2 servers using the MQTT protocol over port 1883 and 8883 (encrypted via SSL/TLS). The command-and-control servers are resolved using DNS-over-HTTPS (DoH).[1][2][3] |
| ID | Mitigation | Description |
|---|---|---|
| M0937 | Filter Network Traffic |
Restrict MQTT, AMQP, DDS, and other publish/subscribe traffic to approved brokers, peers, ports, topics, namespaces, and security zones. Block unauthorized external broker access while preserving documented IIoT/OT messaging paths. |
| M0931 | Network Intrusion Prevention |
Use protocol-aware network controls to detect and, where operationally safe, prevent connections to unapproved brokers or malicious infrastructure and misuse of publish/subscribe protocol features for command-and-control. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0935 | Behavioral Detection of Publish/Subscribe Protocol Misuse for Command and Control | AN2100 |
Real-time monitoring identifies a Windows ICS asset initiating MQTT/AMQP/DDS communications to a broker/service not approved for the asset role, from a process not associated with authorized vendor or telemetry software. Require both a communication-matrix violation and destination/process/protocol corroboration; suppress approved brokers, telemetry collectors, vendor applications, and maintenance. |
| AN2101 |
Real-time monitoring identifies a Linux ICS service or process initiating MQTT/AMQP/DDS communications outside its approved broker/client relationship or from an unauthorized runtime/tool. Require communication-matrix violation plus process/destination/protocol corroboration; suppress approved telemetry, historian, gateway, vendor, and maintenance activity. |
||
| AN2102 |
Real-time monitoring identifies MQTT/AMQP/DDS sessions crossing an unexpected zone boundary, connecting an ICS client to an unapproved broker/service, or using client/topic/message behavior inconsistent with the documented pub/sub architecture. Require topology/identity/topic/destination violation; periodicity alone is not sufficient. |
||
| AN2103 |
Real-time monitoring identifies an embedded OT/IoT device establishing MQTT/AMQP/DDS communication with a broker/service outside its device-specific profile, using an unexpected client identity/topic, or crossing an unauthorized zone boundary. Fixed-function device behavior should be compared to the documented broker/topic/destination profile rather than a generic anomaly threshold. |