T1095 Non-Application Layer Protocol — Attack Simulation

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

ICMP C2
windows automated powershell
Procedure 0268e63c-e244-42db-bef7-72a9e59fc1fc; elevation not declared required; cleanup not declared. Not executed or individually validated.
Powercat C2
windows automated powershell
Procedure 3e0e0e7f-6aa2-4a61-b61d-526c2cc9330e; elevation not declared required; cleanup not declared. Not executed or individually validated.
Linux ICMP Reverse Shell using icmp-cnc
linux manual manual
Procedure 8e139e1f-1f3a-4be7-901d-afae9738c064; elevation not declared required; cleanup not declared. Not executed or individually validated.
Turla Topinambour TCP Callback via Inline .NET
windows automated powershell
Procedure b2858526-001a-4b94-8036-d18dab2898a6; elevation not declared required; cleanup not declared. Not executed or individually validated.
Netcat C2
windows automated powershell
Procedure bcf0d1c1-3f6a-4847-b1c9-7ed4ea321f37; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint network-infrastructure onprem virtualization ESXi Linux macOS Network Devices Windows command-and-control isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate technique source_mapped

Detection and collection

T1095 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.