Which SIEM platforms have a T1001.003 detection rule?

df00tech provides T1001.003 (Protocol or Service Impersonation) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Protocol or Service Impersonation (T1001.003)?

Detecting Protocol or Service Impersonation requires the following data sources: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Microsoft Defender for Endpoint.

What severity and confidence is the T1001.003 detection?

The T1001.003 detection is rated high severity with medium confidence.

What are common false positives for T1001.003?

Common false positives for T1001.003 include: Legitimate monitoring agents (Datadog, SolarWinds, Nagios) that beacon on regular intervals to their management servers; Application performance monitoring tools making regular HTTP health checks from svchost-hosted services; Custom internal applications using non-standard TLS ports for internal API communications.

T1001.003 Google Chronicle · YARA-L

Detect Protocol or Service Impersonation in Google Chronicle

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By mimicking legitimate protocols or web services, adversaries make their C2 traffic blend in with normal network traffic. Techniques include FakeTLS (malformed TLS handshakes that mimic real TLS but use different encryption), custom HTTP header manipulation, URI endpoint spoofing, SSL certificate impersonation, and mimicking well-known services like Gmail or Google Drive. Real-world examples include Lazarus Group's FakeTLS, Cobalt Strike malleable C2 profiles, SUNBURST's OIP protocol masquerading, and Mustang Panda's PUBLOAD/StarProxy tools.

MITRE ATT&CK

Tactic: Command and Control
Technique: T1001 Data Obfuscation
Sub-technique: T1001.003 Protocol or Service Impersonation
Canonical reference: https://attack.mitre.org/techniques/T1001/003/

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

rule t1001_003_protocol_service_impersonation {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects protocol or service impersonation (T1001.003) by identifying suspicious Windows processes making repeated outbound connections to TLS/HTTP ports used in FakeTLS and C2 beaconing. Covers Cobalt Strike malleable C2, SUNBURST-style masquerading, and FakeTLS C2 patterns."
    mitre_attack_tactic = "Command And Control"
    mitre_attack_technique = "T1001.003"
    severity = "HIGH"
    confidence = "MEDIUM"
    version = "1.0"
    created = "2026-04-13"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.network.direction = "OUTBOUND"
    $e.target.port in (443, 8443, 4443, 8080, 8888)
    not $e.target.ip in cidr(
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "127.0.0.0/8"
    )
    $e.principal.process.file.full_path != /(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|teams\.exe|slack\.exe|zoom\.exe|outlook\.exe|onedrive\.exe)$/
    $e.principal.process.file.full_path = /(?i)(svchost\.exe|lsass\.exe|rundll32\.exe|regsvr32\.exe|mshta\.exe|wscript\.exe|cscript\.exe|msbuild\.exe|installutil\.exe|regasm\.exe|regsvcs\.exe|certutil\.exe|bitsadmin\.exe)$/
    $hostname = $e.principal.hostname
    $proc = $e.principal.process.file.full_path
    $dest_ip = $e.target.ip
    $dest_port = $e.target.port

  match:
    $hostname, $proc, $dest_ip, $dest_port over 24h

  outcome:
    $connection_count = count_distinct($e.metadata.id)
    $unique_dest_ips = count_distinct($e.target.ip)
    $total_bytes_sent = sum($e.network.sent_bytes)
    $first_seen = min($e.metadata.event_timestamp.seconds)
    $last_seen = max($e.metadata.event_timestamp.seconds)
    $suspicion_detail = array_distinct($e.principal.process.file.full_path)

  condition:
    #e >= 3
}

high severity medium confidence

Chronicle YARA-L 2.0 rule detecting protocol or service impersonation C2 activity by correlating outbound network connections from suspicious Windows LOLBin processes to TLS and HTTP ports commonly abused for FakeTLS and malleable C2 profiles. Matches on the same behavioral indicators as the KQL/SPL detections: suspicious process initiating connections, TLS-port targeting, and connection count thresholds indicating beaconing.

Data Sources

Chronicle UDM with Windows Sysmon ingestionGoogle Chronicle network telemetryEndpoint Detection and Response (EDR) telemetry via Chronicle

Required Tables

UDM NETWORK_CONNECTION events with principal process context

False Positives & Tuning

Windows processes that legitimately host third-party DLLs (svchost.exe hosting plugin DLLs for antivirus or monitoring software) may make outbound HTTPS connections matching the suspicious process criteria — validate by reviewing the hosting service name and DLL path
Scripting engines (wscript.exe, cscript.exe) used by legitimate administrative automation scripts for health checks or monitoring will generate connections to internal or cloud management endpoints — verify script origin and digital signature
certutil.exe used by administrators for legitimate certificate operations or PKI management that involves downloading CRL/OCSP data from public PKI infrastructure will trigger this rule — correlate with planned PKI maintenance windows

Download portable Sigma rule (.yml)

Other platforms for T1001.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1FakeTLS Simulation: Raw TCP Connection on TLS Port
Expected signal: Sysmon Event ID 3: Network Connection with Image=powershell.exe, DestinationPort=4443, DestinationIp=127.0.0.1. Sysmon Event ID 1: Process Create with powershell.exe and TcpClient in CommandLine. The connection attempt will appear in network logs regardless of whether a listener exists.
Test 2HTTP Header Manipulation: Cobalt Strike-Style Malleable C2 Simulation
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 1: Process Create showing powershell.exe with WebRequest in CommandLine. If proxy logs are available, the manipulated HTTP headers (fake User-Agent, encoded cookie) would be visible. PowerShell ScriptBlock Event ID 4104 captures the full script including the fake headers.
Test 3DNS-Based Protocol Impersonation: DNS Tunneling Simulation
Expected signal: Sysmon Event ID 22: DNS Query events for each subdomain query (aGVsbG8.c2test.invalid, aG9zdG5hbWU.c2test.invalid, etc.) with Image=powershell.exe. Sysmon Event ID 1: Process Create for powershell.exe. Windows DNS Client event log may also capture the failed DNS resolutions. All queries will return NXDOMAIN.
Test 4SUNBURST-Style Protocol Mimicry: Fake OIP Traffic Pattern
Expected signal: Sysmon Event ID 3: Three Network Connection events from powershell.exe to 127.0.0.1:8080 with distinct URIs. Sysmon Event ID 1: Process Create for powershell.exe. PowerShell ScriptBlock Event ID 4104: Full script content including OIP-mimicking User-Agent and custom X-Solarwinds-Request header. If a web proxy is in the traffic path, it would log the fake Orion User-Agent from a non-Orion process.

Last updated: 2026-04-13 Research depth: deep

References (13)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1001.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Protocol or Service Impersonation in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1001.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1001.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

Get new detections in your inbox