T1071.001 Web Protocols — Attack Simulation

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in environments. HTTP/S packets have many fields and…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Malicious User Agents - Nix
linux macos automated sh
Procedure 2d7c471a-e887-4b78-b0dc-b0df1f2e0658; elevation not declared required; cleanup not declared. Not executed or individually validated.
Malicious User Agents - Powershell
windows automated powershell
Procedure 81c13829-f6c9-45b8-85a6-053366d55297; elevation not declared required; cleanup not declared. Not executed or individually validated.
Malicious User Agents - CMD
windows automated command_prompt
Procedure dc3488b0-08c7-4fea-b585-905c83b48180; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint network-infrastructure onprem virtualization ESXi Linux macOS Network Devices Windows command-and-control isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1071.001 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.