Non-Application Layer Protocol

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.[1] Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

ICMP communication between hosts is one example.[2] Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts; [3] however, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.

ID: T1095
Sub-techniques:  No sub-techniques
Tactic: Command And Control
Platforms: Linux, Network, Windows, macOS
Data Sources: Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Requires Network:  Yes
Contributors: Ryan Becwar
Version: 2.1
Created: 31 May 2017
Last Modified: 21 October 2020

Procedure Examples

Name Description
Anchor

Anchor has used ICMP in C2 communications.[4]

APT29

APT29 uses TCP for C2 communications.[5]

APT3

An APT3 downloader establishes SOCKS5 connections for its initial C2.[6]

Aria-body

Aria-body has used TCP in C2 communications.[7]

BUBBLEWRAP

BUBBLEWRAP can communicate using SOCKS.[8]

Carbon

Carbon uses TCP and UDP for C2.[9]

Crimson

Crimson uses a custom TCP protocol for C2.[10]

Cryptoistic

Cryptoistic can use TCP in communications with C2.[11]

Derusbi

Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.[12]

Drovorub

Drovorub can use TCP to communicate between its agent and client modules.[13]

FakeM

Some variants of FakeM use SSL to communicate with C2 servers.[14]

FIN6

FIN6 has used Metasploit Bind and Reverse TCP stagers.[15]

gh0st RAT

gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.[16]

HiddenWasp

HiddenWasp communicates with a simple network protocol over TCP.[17]

InvisiMole

InvisiMole has used TCP to download additional modules.[18]

Metamorfo

Metamorfo has used raw TCP for C2.[19]

Mis-Type

Mis-Type network traffic can communicate over a raw socket.[20]

Misdat

Misdat network traffic communicates over a raw socket.[20]

MoonWind

MoonWind completes network communication via raw sockets.[21]

NETEAGLE

If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.[22]

PHOREAL

PHOREAL communicates via ICMP for C2.[23]

PipeMon

The PipeMon communication module can use a custom protocol based on TLS over TCP.[24]

PLATINUM

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.[25]

PlugX

PlugX can be configured to use raw TCP or UDP for command and control.[26]

RARSTONE

RARSTONE uses SSL to encrypt its communication with its C2 server.[27]

Reaver

Some Reaver variants use raw TCP for C2.[28]

Regin

The Regin malware platform can use ICMP to communicate between infected computers.[29]

Remsec

Remsec is capable of using ICMP, TCP, and UDP for C2.[30][31]

SDBot

SDBot has the ability to communicate with C2 with TCP over port 443.[32]

TSCookie

TSCookie can use ICMP to receive information on the destination server.[33]

Umbreon

Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.[34]

WellMail

WellMail can use TCP for C2 communications.[35]

WINDSHIELD

WINDSHIELD C2 traffic can communicate via TCP raw sockets.[23]

Winnti for Linux

Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.[36]

Mitigations

Mitigation Description
Filter Network Traffic

Filter network traffic to prevent use of protocols across the network boundary that are unnecessary.

Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Network Segmentation

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.

Detection

Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.[37]

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.[38]

Monitor and investigate API calls to functions associated with enabling and/or utilizing alternative communication channels.

References

  1. Wikipedia. (n.d.). List of network protocols (OSI model). Retrieved December 4, 2014.
  2. Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.
  3. Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics. Retrieved December 1, 2014.
  4. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  5. Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018.
  6. Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
  7. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  8. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  9. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  10. Huss, D.. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  11. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
  12. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  13. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.
  14. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  15. Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020.
  16. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.
  17. Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.
  18. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  19. Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.
  1. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  2. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  3. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  4. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  5. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
  6. Kaplan, D, et al. (2017, June 7). PLATINUM continues to evolve, find ways to maintain invisibility. Retrieved February 19, 2018.
  7. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
  8. Aquino, M. (2013, June 13). RARSTONE Found In Targeted Attacks. Retrieved December 17, 2015.
  9. Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
  10. Kaspersky Lab's Global Research and Analysis Team. (2014, November 24). THE REGIN PLATFORM NATION-STATE OWNAGE OF GSM NETWORKS. Retrieved December 1, 2014.
  11. Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.
  12. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.
  13. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  14. Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.
  15. Fernando Mercês. (2016, September 5). Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems. Retrieved March 5, 2018.
  16. CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.
  17. Chronicle Blog. (2019, May 15). Winnti: More than just Windows and Gates. Retrieved April 29, 2020.
  18. Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.
  19. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.