Use intrusion detection signatures to block traffic at network boundaries.
MITRE mitigation sourceAdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Protocol or Service Impersonation
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Network behavior, protocols, and configuration recovery
Malware Analysis & Reverse Engineering · Governed topic match · 51/100Module 5 — Threat hunting
Blue Team & Defensive Security · Governed topic match · 42/100Module 8 — Network defense, protocol analysis, and NDR
Blue Team & Defensive Security · Governed topic match · 42/100Intake, provenance, and analysis scope
Malware Analysis & Reverse Engineering · Governed topic match · 30/100Architecture, calling conventions, and assembly literacy
Malware Analysis & Reverse Engineering · Governed topic match · 30/100Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100Disassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100
Malware Analysis & Reverse Engineering · Governed topic match · 51/100Module 5 — Threat hunting
Blue Team & Defensive Security · Governed topic match · 42/100Module 8 — Network defense, protocol analysis, and NDR
Blue Team & Defensive Security · Governed topic match · 42/100Intake, provenance, and analysis scope
Malware Analysis & Reverse Engineering · Governed topic match · 30/100Architecture, calling conventions, and assembly literacy
Malware Analysis & Reverse Engineering · Governed topic match · 30/100Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100Disassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100
MITRE mitigations
MITRE detection strategies and analytics
- AN1294 · Analytic 1294 — Untrusted processes creating outbound TLS/HTTPS connections with malformed certificates or header fields, often mismatched with target service behavior. Detects protocol impersonation attempts via traffic metadata analysis and host process lineage.
- AN1295 · Analytic 1295 — Detection of binaries spawning encrypted sessions using OpenSSL or curl to external services with mismatched ports/protocols. Identifies behavior where internal services simulate trusted cloud service traffic patterns.
- AN1296 · Analytic 1296 — Unsigned or suspicious applications initiating network traffic claiming to be browser, mail, or cloud clients. Detects impersonation via TLS fingerprint and User-Agent string deviation.
- AN1297 · Analytic 1297 — ESXi hosts initiating connections from non-standard daemons mimicking HTTP/HTTPS or SNMP traffic, but with irregular payload formats or expired/unsigned TLS certificates.