{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1071","id":"T1071","name":"Application Layer Protocol","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1071","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"00c7e26175b3d13703238fec3d607c92caa32850896226d4807e5d42f844d22d","description":"Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nAdversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1071","external_id":"T1071"},{"source_name":"University of Birmingham C2","description":"Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.","url":"https://arxiv.org/pdf/1408.1136"},{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","description":"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}],"platforms":["Linux","macOS","Windows","Network Devices","ESXi"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"},{"key":"enterprise/T1071.002","id":"T1071.002","name":"File Transfer Protocols","page":"techniques/enterprise/T1071.002/"},{"key":"enterprise/T1071.003","id":"T1071.003","name":"Mail Protocols","page":"techniques/enterprise/T1071.003/"},{"key":"enterprise/T1071.004","id":"T1071.004","name":"DNS","page":"techniques/enterprise/T1071.004/"},{"key":"enterprise/T1071.005","id":"T1071.005","name":"Publish/Subscribe Protocols","page":"techniques/enterprise/T1071.005/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1071","id":"T1071","name":"Application Layer Protocol","domain":"enterprise","platforms":["Linux","macOS","Windows","Network Devices","ESXi"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1071","technique_page":"techniques/enterprise/T1071/","page":"detections/enterprise/T1071/","status":"rule_source_available","counts":{"sigma":5,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"e0cfaecd-602d-41af-988d-f6ccebb2af26","title":"Suspicious Installer Package Child Process","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/e0cfaecd-602d-41af-988d-f6ccebb2af26.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml","author":"Sohan G (D4rkCiph3r)","kind":"sigma"},{"id":"75c505b1-711d-4f68-a357-8c3fe37dbf2d","title":"HackTool - SILENTTRINITY Stager DLL Load","status":"test","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/75c505b1-711d-4f68-a357-8c3fe37dbf2d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_hktl_silenttrinity_stager.yml","author":"Aleksey Potapov, oscd.community","kind":"sigma"},{"id":"5bac7a56-da88-4c27-922e-c81e113b20cb","title":"Github Self-Hosted Runner Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5bac7a56-da88-4c27-922e-c81e113b20cb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml","author":"Daniel Koifman (KoifSec)","kind":"sigma"},{"id":"03552375-cc2c-4883-bbe4-7958d5a980be","title":"HackTool - SILENTTRINITY Stager Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/03552375-cc2c-4883-bbe4-7958d5a980be.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml","author":"Aleksey Potapov, oscd.community","kind":"sigma"},{"id":"0ea52357-cd59-4340-9981-c46c7e900428","title":"Potentially Suspicious Rundll32.EXE Execution of UDL File","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0ea52357-cd59-4340-9981-c46c7e900428.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_udl_exec.yml","author":"@kostastsale","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[{"id":"atlas-anomaly-t1071-1","technique_id":"T1071","title":"Endpoint communicates periodically with external destination — T1071 Application Layer Protocol","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#periodic-c2","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":109,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L109","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"5ac764371c7e4f927d2dac3374ba5a1ad7144e0d105e60a480ec966b939a6a60","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"source-destination event series.","expected_behavior":"human and application traffic has characteristic timing variability.","deviation":"strong periodicity, unusual autocorrelation, or repeated fixed inter-arrival times.","anomaly_types":[{"title":"Periodicity Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#27-periodicity-anomaly"},{"title":"Autocorrelation Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#32-autocorrelation-anomaly"},{"title":"Inter-Arrival-Time Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#19-inter-arrival-time-anomaly"}],"log_sources":[{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"Network Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#60-network-detection-and-response-telemetry"}],"context_references":[{"title":"Mandiant SUNBURST investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/mandiant-sunburst-supply-chain.html"},{"title":"original source","url":"https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor/"}]}],"anomaly_types":[{"title":"Autocorrelation Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#32-autocorrelation-anomaly"},{"title":"Inter-Arrival-Time Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#19-inter-arrival-time-anomaly"},{"title":"Periodicity Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#27-periodicity-anomaly"}],"strategies":[{"id":"DET0444","name":"Detection of Command and Control Over Application Layer Protocols","url":"https://attack.mitre.org/detectionstrategies/DET0444","stix_id":"x-mitre-detection-strategy--155cab5b-c70b-4cfb-ba52-f62a21836b19","relationship_id":"relationship--2e32bb11-7263-46e8-b96c-c8769e7001df","description":"","analytics":[{"id":"AN1225","name":"Analytic 1225","guidance":"Detects suspicious usage of common application-layer protocols (e.g., HTTP, HTTPS, DNS, SMB) by abnormal processes, with high outbound byte counts or irregular ports, possibly indicating command and control or data exfiltration.","url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1225","platforms":["Windows"],"tuning":[{"field":"ProtocolList","description":"Limit detection to app-layer protocols of interest: HTTP, DNS, SSL, SMB, RDP"},{"field":"DataVolumeThreshold","description":"Detects asymmetric communication volume (e.g., >90% outbound)"},{"field":"UnusualProcessList","description":"Track processes not normally associated with network activity"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"http, dns, smb, ssl logs","platforms":["Windows"],"analytic_id":"AN1225","source_url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1225","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1225","source_url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1225","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1226","name":"Analytic 1226","guidance":"Detects suspicious curl, wget, or custom socket traffic that leverages DNS, HTTPS, or IRC-style protocols with unbalanced traffic or beacon-like intervals.","url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1226","platforms":["Linux"],"tuning":[{"field":"KnownPortsToMonitor","description":"Uncommon ports for HTTPS, IRC, DNS (e.g., 8443, 5353)"},{"field":"BeaconTimingThreshold","description":"Detect intervals of outbound traffic within fixed timeframes"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"dns, ssl, conn","platforms":["Linux"],"analytic_id":"AN1226","source_url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1226","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1226","source_url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1226","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1227","name":"Analytic 1227","guidance":"Detects applications using abnormal protocols or high volume traffic not previously associated with the process image, such as Automator or AppleScript invoking curl or python sockets.","url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1227","platforms":["macOS"],"tuning":[{"field":"SocketParentProcessMatch","description":"Non-browser processes opening sockets to external IPs"},{"field":"DataFlowImbalanceRatio","description":"High outbound/inbound ratio indicating C2 beacon"}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"macos:osquery","channel":"socket_events","platforms":["macOS"],"analytic_id":"AN1227","source_url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1227","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"log stream","platforms":["macOS"],"analytic_id":"AN1227","source_url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1227","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1228","name":"Analytic 1228","guidance":"Detects application-layer tunneling or unauthorized app protocols like DNS-over-HTTPS, embedded C2 in TLS/HTTP headers, or misused SMB traffic crossing VLANs.","url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1228","platforms":["Network Devices"],"tuning":[{"field":"AppProtocolAbusePattern","description":"Detects DNS tunneling, encrypted HTTP C2, or malformed headers"},{"field":"NorthSouthEgressFilter","description":"Monitor internal hosts talking externally using internal protocols (e.g., SMB)"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"conn.log, http.log, dns.log, ssl.log","platforms":["Network Devices"],"analytic_id":"AN1228","source_url":"https://attack.mitre.org/detectionstrategies/DET0444#AN1228","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"software":[{"id":"S0034","name":"NETEAGLE","url":"https://attack.mitre.org/software/S0034","kind":"malware","description":"Adversaries can also use [NETEAGLE](https://attack.mitre.org/software/S0034) to establish an RDP connection with a controller over TCP/7519.","relationship_id":"relationship--32abb557-d923-4a6d-bda6-79a95063f298","references":[]},{"id":"S0038","name":"Duqu","url":"https://attack.mitre.org/software/S0038","kind":"malware","description":"[Duqu](https://attack.mitre.org/software/S0038) uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.(Citation: Symantec W32.Duqu)","relationship_id":"relationship--8d0d938e-2e4c-49e8-9290-6bfb86161260","references":[{"source_name":"Symantec W32.Duqu","description":"Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}]},{"id":"S0532","name":"Lucifer","url":"https://attack.mitre.org/software/S0532","kind":"malware","description":"[Lucifer](https://attack.mitre.org/software/S0532) can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.(Citation: Unit 42 Lucifer June 2020)","relationship_id":"relationship--bfc5ca31-5d92-4c51-be33-e610df85055a","references":[{"source_name":"Unit 42 Lucifer June 2020","description":"Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has used an IRC channel for C2 communications.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--24f1177a-971a-457f-a9b6-36de5fc65d42","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) connects to an IRC server for C2.(Citation: Unit 42 Siloscape Jun 2021)","relationship_id":"relationship--79fd974c-b51b-45d4-b220-6f532ec6bc63","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0633","name":"Sliver","url":"https://attack.mitre.org/software/S0633","kind":"tool","description":"[Sliver](https://attack.mitre.org/software/S0633) can utilize the Wireguard VPN protocol for command and control.(Citation: Cybereason Sliver Undated)","relationship_id":"relationship--bea6dae9-de47-4b9d-a393-8bf543220ecb","references":[{"source_name":"Cybereason Sliver Undated","description":"Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.","url":"https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) has the ability to use Telnet for communication.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--924d69bd-a87f-4fda-a2cb-73355331aa87","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S1084","name":"QUIETEXIT","url":"https://attack.mitre.org/software/S1084","kind":"malware","description":"[QUIETEXIT](https://attack.mitre.org/software/S1084) can use an inverse negotiated SSH connection as part of its C2.(Citation: Mandiant APT29 Eye Spy Email Nov 22)","relationship_id":"relationship--89544a80-5144-443a-9560-ab8b7a87fa96","references":[{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","description":"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) is capable of contacting the TOR network for delivering second-stage payloads.(Citation: RedCanary RaspberryRobin 2022)(Citation: TrendMicro RaspberryRobin 2022)(Citation: HP RaspberryRobin 2024)","relationship_id":"relationship--d863f0be-98bb-42d5-a584-f48fc43022aa","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"},{"source_name":"RedCanary RaspberryRobin 2022","description":"Lauren Podber and Stef Rand. (2022, May 5). Raspberry Robin gets the worm early. Retrieved May 17, 2024.","url":"https://redcanary.com/blog/threat-intelligence/raspberry-robin/"},{"source_name":"HP RaspberryRobin 2024","description":"Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) uses TCP and UDP communication for command and control traffic.(Citation: ESET EvasivePanda 2024)(Citation: Symantec Daggerfly 2024)","relationship_id":"relationship--fd864eec-92f0-4401-8f1e-38130cc6d2e2","references":[{"source_name":"ESET EvasivePanda 2024","description":"Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"},{"source_name":"Symantec Daggerfly 2024","description":"Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"}]}],"actors":[{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) malware has used IRC for C2.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--2b5af448-59a1-4888-a05f-aee6105872a5","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"Unit 42 Magic Hound Feb 2017","description":"Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) issued wget requests from infected systems to the C2.(Citation: Talos Rocke August 2018)","relationship_id":"relationship--37327da8-efd3-48c0-9f91-38f384f8579e","references":[{"source_name":"Talos Rocke August 2018","description":"Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has used an IRC bot for C2 communications.(Citation: Trend Micro TeamTNT)","relationship_id":"relationship--d0e68e5d-66a1-4f7d-ace6-8ad5d028fa20","references":[{"source_name":"Trend Micro TeamTNT","description":"Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) has used valid accounts over RDP to connect to targeted systems.(Citation: Huntress INC Ransom Group August 2023)","relationship_id":"relationship--6521c093-6e80-4669-9151-1c4df2dac259","references":[{"source_name":"Huntress INC Ransom Group August 2023","description":"Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) has used reverse SSH tunnels to communicate to victim devices.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--c812f373-23ba-4825-aa0b-6546cf6105e8","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has leveraged reverse SSH shells for command and control.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--864785e4-0495-42a0-8ac6-5f1e71928b65","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.","relationship_id":"relationship--19f35c88-92c4-4e98-b024-be9f6731bdb5","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.","relationship_id":"relationship--ee0f724e-6622-40db-8a31-82fb6b361e0b","references":[]}],"candidates":[{"id":"3b0df731-030c-4768-b492-2a3216d90e53","name":"Telnet C2","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1071/T1071.yaml","description":"An adversary may establish Telnet communication from a compromised endpoint to a command and control (C2) server in order to carry out additional attacks on objectives.\n","inputs":{"server_ip":{"description":"C2 server IP or URL","type":"url","default":"127.0.0.1"},"client_path":{"description":"Client agent path","type":"path","default":"PathToAtomicsFolder\\T1071\\bin\\telnet_client.exe"},"server_port":{"description":"C2 server port","type":"integer","default":23}},"dependencies":[{"description":"A command and control (C2) server can be established by running PathToAtomicsFolder\\T1071\\bin\\telnet_server.exe on a specified server with a specified IP that must be reachable by a client (telnet_client.exe)\n"}],"source_definition_sha256":"a73868bbdfc5485dab18138482ed6cb7cbd2627126901425168c0d95f4a53087"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1071":"/ttp-simulation/techniques/enterprise/T1071/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1071","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}