T1071.001 Web Protocols — Detection Rules

Source-backed rule directory

• Suspicious Curl Change User Agents - Linux · test · medium · {"category":"process_creation","product":"linux"}
• Suspicious Installer Package Child Process · test · medium · {"category":"process_creation","product":"macos"}
• Wannacry Killswitch Domain · test · high · {"category":"dns"}
• Windows WebDAV User Agent · test · high · {"category":"proxy"}
• HackTool - BabyShark Agent Default URL Pattern · test · critical · {"category":"proxy"}
• HackTool - CobaltStrike Malleable Profile Patterns - Proxy · test · high · {"category":"proxy"}
• HackTool - Empire UserAgent URI Combo · test · high · {"category":"proxy"}
• PwnDrp Access · test · critical · {"category":"proxy"}
• Raw Paste Service Access · test · high · {"category":"proxy"}
• Telegram API Access · test · medium · {"category":"proxy"}
• APT User Agent · test · high · {"category":"proxy"}
• Suspicious Base64 Encoded User-Agent · test · medium · {"category":"proxy"}
• Bitsadmin to Uncommon IP Server Address · test · high · {"category":"proxy"}
• Bitsadmin to Uncommon TLD · test · high · {"category":"proxy"}
• Crypto Miner User Agent · test · high · {"category":"proxy"}
• HTTP Request With Empty User Agent · test · medium · {"category":"proxy"}
• Exploit Framework User Agent · test · high · {"category":"proxy"}
• Malware User Agent · test · high · {"category":"proxy"}
• Windows PowerShell User Agent · test · medium · {"category":"proxy"}
• Suspicious User Agent · test · high · {"category":"proxy"}
• Potential Base64 Encoded User-Agent · test · medium · {"category":"proxy"}
• Cloudflared Tunnels Related DNS Requests · test · medium · {"category":"dns_query","product":"windows"}
• DNS Query To Devtunnels Domain · test · medium · {"category":"dns_query","product":"windows"}
• DNS Query Request By QuickAssist.EXE · experimental · low · {"category":"dns_query","product":"windows"}
• DNS Query To Visual Studio Code Tunnels Domain · test · medium · {"product":"windows","category":"dns_query"}
• Outbound Network Connection Initiated By Microsoft Dialer · test · high · {"category":"network_connection","product":"windows"}
• Change User Agents with WebRequest · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Visual Studio Code Tunnel Execution · test · medium · {"category":"process_creation","product":"windows"}
• Visual Studio Code Tunnel Shell Execution · test · medium · {"category":"process_creation","product":"windows"}
• Renamed Visual Studio Code Tunnel Execution · test · high · {"category":"process_creation","product":"windows"}
• Visual Studio Code Tunnel Service Installation · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1071.001 Web Protocols

MATCH(destination_or_url IN denylist OR http_signature IN known_c2_patterns) -> ALERT

• Proxy and Secure Web Gateway Logs
• Network Intrusion Detection Logs
• Network Metadata Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets

AN0075 Analytic 0075

Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

AN0076 Analytic 0076

Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

AN0077 Analytic 0077

Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

AN0078 Analytic 0078

Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

AN0079 Analytic 0079

Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.