Non-Application Layer Protocol `T1095`

Tactic: Command & Control

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

Events covered

16 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 5140	A network share object was accessed.
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	Event ID 5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	Event ID 5159	The Windows Filtering Platform has blocked a bind to a local port.
ESF	exec	Process Execution
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 400	Event ID 400
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 46 rules share fields, values, and exclusions.

Fields filtered most (52 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`event.type`	18	`eq` 17, `in` 1	`start`, `process_started`
`EventType`	17	`in` 10, `eq` 9, `is_null` 1	`exec`, `connection_attempted`, `connection_accepted`, `ProcessRollup2`, `exec_event`
`process_basename`	17	`eq` 9, `in` 8, `wildcard` 4, `starts_with` 2	`bash`, `csh`, `dash`, `awk`, `busybox`
`process.args`	11	`wildcard` 7, `contains` 6, `eq` 5, `in` 3, `regex_match` 1, `starts_with` 1	`/bin/sh`, `/inet/tcp/`, `TCPSocket.new`, `-e`, `-l*`
`EventID`	8	`eq` 8	`1`, `4104`, `4688`, `5156`, `4625`
`parent_process_basename`	8	`eq` 4, `in` 4, `wildcard` 2, `starts_with` 1	`bash`, `csh`, `dash`, `socat`, `*.cgi`
`dest_ip`	6	`is_not_null` 6, `ne` 1	, `127.0.0.1`, `::1`
`CommandLine`	5	`regex_match` 4, `contains` 1, `in` 1	`(?i)(\-\-dns)?((\s+)\|(\=))?((server\=)\|(host\=))?((\d{1,3...`, `--lua-exec` , `--sh-exec` , `-l --proxy-type http` , `(?i)(socks\d\w?:\/\/\|--(pre)?proxy)`
`Image`	4	`starts_with` 2, `ends_with` 1, `wildcard` 1	`./`, `/boot/`, `/dev/shm/`, `/bin/lua`, `/bin/perl*`
`process.parent.args`	4	`contains` 3, `wildcard` 2, `eq` 1	`exec`, `--port`, `-Dsolr.solr.home=`, `/app/.js`, `-l*`
`Query`	3	`in` 2, `contains` 1	`api.2ip.ua`, `api.ipify.org`, `canireachthe.net`, `dyn.com`, `dynu.com`
`container.id`	3	`starts_with` 2, `wildcard` 1	`?`, ``
`data_stream.dataset`	3	`eq` 2, `in` 1, `is_null` 1, `ne` 1	, `gcp.audit`, `network_traffic.flow`, `network_traffic.icmp`, `panw.panos`
`src_ip`	3	`cidr_match` 2, `in` 1	`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `127.0.0.0/8`, `169.254.0.0/16`
`EventResultDetails`	2	`in` 2	`NXDOMAIN`, `REFUSED`, `SERVFAIL`

Top indicator values (819 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticFile Transfer or Listener Established via Netcat elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticNetcat Listener Established via rlwrap elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNetwork Connection via Recently Compiled Executable elasticPotential Command Shell via NetCat elasticPotential Reverse Shell elasticPotential Reverse Shell via Background Process elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticSuspicious React Server Child Process +1 more rules	16	1036
`EventType`	`eq`	`exec` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNetwork Connection via Recently Compiled Executable elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticWeb Server Exploitation Detected via Defend for Containers	8	547
`EventType`	`in`	`exec` elasticFile Transfer or Listener Established via Netcat elasticNetcat Listener Established via rlwrap elasticPotential Reverse Shell elasticPotential Reverse Shell via Background Process elasticPotential Reverse Shell via Suspicious Child Process elasticSuspicious React Server Child Process	6	180
`EventType`	`in`	`connection_attempted` elasticNetwork Activity Detected via cat elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process	5	24
`EventType`	`in`	`connection_accepted` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process	4	14
`EventType`	`in`	`start` elasticFile Transfer or Listener Established via Netcat elasticNetcat Listener Established via rlwrap elasticPotential Reverse Shell via Background Process elasticSuspicious React Server Child Process	4	157
`EventType`	`in`	`ProcessRollup2` elasticFile Transfer or Listener Established via Netcat elasticNetcat Listener Established via rlwrap elasticPotential Reverse Shell via Background Process	3	119
`EventType`	`in`	`exec_event` elasticFile Transfer or Listener Established via Netcat elasticNetcat Listener Established via rlwrap elasticPotential Reverse Shell via Background Process	3	135
`dest_ip`	`is_not_null`	elasticNetwork Connection via Recently Compiled Executable elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP	6	19
`process_basename`	`in`	`bash` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell Activity via Terminal elasticPotential Reverse Shell via Child elasticSuspicious React Server Child Process elasticWeb Server Exploitation Detected via Defend for Containers	6	181
`process_basename`	`in`	`dash` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell Activity via Terminal elasticPotential Reverse Shell via Child elasticSuspicious React Server Child Process elasticWeb Server Exploitation Detected via Defend for Containers	6	150
`process_basename`	`in`	`sh` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell Activity via Terminal elasticPotential Reverse Shell via Child elasticSuspicious React Server Child Process elasticWeb Server Exploitation Detected via Defend for Containers	6	180
`process_basename`	`in`	`zsh` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell Activity via Terminal elasticPotential Reverse Shell via Child elasticSuspicious React Server Child Process elasticWeb Server Exploitation Detected via Defend for Containers	6	180
`process_basename`	`in`	`csh` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticWeb Server Exploitation Detected via Defend for Containers	4	148
`process_basename`	`in`	`fish` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticWeb Server Exploitation Detected via Defend for Containers	4	151
`process_basename`	`in`	`ksh` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticWeb Server Exploitation Detected via Defend for Containers	4	149
`process_basename`	`in`	`tcsh` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticWeb Server Exploitation Detected via Defend for Containers	4	145
`process_basename`	`in`	`busybox` elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticSuspicious React Server Child Process elasticWeb Server Exploitation Detected via Defend for Containers	3	67
`process_basename`	`in`	`nc` elasticFile Transfer or Listener Established via Netcat elasticNetcat File Transfer or Listener Detected via Defend for Containers elasticSuspicious React Server Child Process	3	19
`CommandLine`	`regex_match`	`(?i)(\-\-dns)?((\s+)\|(\=))?((server\=)\|(host\=))?((\d{1,3}\.\d{1,3}\.\d{1,3}\...` splunkTunneling Process Created (PowerShell) splunkTunneling Process Created (Sysmon) splunkTunneling Process Created (Windows Event Log)	3	3
`process.args`	`contains`	`socket` elasticPotential Reverse Shell via Suspicious Child Process elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticSuspicious React Server Child Process	3	7
`process.args`	`eq`	`-e` elasticPotential Reverse Shell via Suspicious Child Process elasticSuspicious Interpreter Execution Detected via Defend for Containers elasticSuspicious React Server Child Process	3	42
`process_basename`	`eq`	`bash` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	10
`process_basename`	`eq`	`csh` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	6
`process_basename`	`eq`	`dash` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	8
`process_basename`	`eq`	`fish` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	6
`process_basename`	`eq`	`ksh` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	7
`process_basename`	`eq`	`sh` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	10
`process_basename`	`eq`	`tcsh` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	7
`process_basename`	`eq`	`zsh` elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Binary	3	10

Exclusions (160 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`dest_ip`	`cidr_match`	`127.0.0.0/8` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNetwork Connection via Recently Compiled Executable elasticNewly Observed IPSEC NAT Traversal Peer elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP kustoUbiquiti - Possible connection to cryptominning pool	9
`dest_ip`	`cidr_match`	`169.254.0.0/16` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNetwork Connection via Recently Compiled Executable elasticNewly Observed IPSEC NAT Traversal Peer elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP kustoUbiquiti - Possible connection to cryptominning pool	9
`dest_ip`	`cidr_match`	`224.0.0.0/4` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNetwork Connection via Recently Compiled Executable elasticNewly Observed IPSEC NAT Traversal Peer elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP	8
`dest_ip`	`cidr_match`	`::1` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNetwork Connection via Recently Compiled Executable elasticNewly Observed IPSEC NAT Traversal Peer elasticPotential Reverse Shell elasticPotential Reverse Shell via Child elasticPotential Reverse Shell via Suspicious Child Process elasticPotential Reverse Shell via UDP	8
`dest_ip`	`cidr_match`	`10.0.0.0/8` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer kustoUbiquiti - Possible connection to cryptominning pool	4
`dest_ip`	`cidr_match`	`172.16.0.0/12` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer kustoUbiquiti - Possible connection to cryptominning pool	4
`dest_ip`	`cidr_match`	`192.168.0.0/16` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer kustoUbiquiti - Possible connection to cryptominning pool	4
`dest_ip`	`cidr_match`	`100.64.0.0/10` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3
`dest_ip`	`cidr_match`	`192.0.0.0/24` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3
`dest_ip`	`cidr_match`	`192.0.0.0/29` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3
`dest_ip`	`cidr_match`	`192.0.0.10/32` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3
`dest_ip`	`cidr_match`	`192.0.0.170/32` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3
`dest_ip`	`cidr_match`	`192.0.0.171/32` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3
`dest_ip`	`cidr_match`	`192.0.0.8/32` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3
`dest_ip`	`cidr_match`	`192.0.0.9/32` elasticNetwork Activity Detected via cat elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticNewly Observed IPSEC NAT Traversal Peer	3

Non-Application Layer Protocol `T1095`

Events covered

Authoring guide

Fields filtered most (52 distinct)

Top indicator values (819 distinct)

Exclusions (160 distinct)

Rules under this technique

Sigma 3 rules

Elastic 20 rules

Splunk 11 rules

Kusto 11 rules

Panther 1 rule

Non-Application Layer Protocol T1095

Events covered

Authoring guide

Fields filtered most (52 distinct)

Top indicator values (819 distinct)

Exclusions (160 distinct)

Rules under this technique

Sigma 3 rules

Elastic 20 rules

Splunk 11 rules

Kusto 11 rules

Panther 1 rule

Non-Application Layer Protocol `T1095`