| ID | Name |
|---|---|
| T1437.001 | Web Protocols |
Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the mobile device, and often the results of those commands, will be embedded within the protocol traffic between the mobile device and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.
| ID | Name | Description |
|---|---|---|
| S1083 | Chameleon | |
| S1243 | DCHSpy |
DCHSpy has uploaded collected data to a Secure File Transfer Protocol (SFTP) server.[2] |
| S0550 | DoubleAgent |
DoubleAgent has used both FTP and TCP sockets for data exfiltration.[3] |
| S1054 | Drinik |
Drinik has code to use Firebase Cloud Messaging for receiving C2 instructions.[4] |
| S9040 | NGate |
NGate has used TCP sockets to communicate with the C2 server.[5] |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors used HTTPS POST requests for C2 communication.[6] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0685 | Detection of Application Layer Protocol | AN1793 |
For Android, detect Exfiltration Over Alternative Protocol by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1794 |
For iOS, detect Application Layer Protocol by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |