Detect Protocol or Service Impersonation in Elastic Security
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By mimicking legitimate protocols or web services, adversaries make their C2 traffic blend in with normal network traffic. Techniques include FakeTLS (malformed TLS handshakes that mimic real TLS but use different encryption), custom HTTP header manipulation, URI endpoint spoofing, SSL certificate impersonation, and mimicking well-known services like Gmail or Google Drive. Real-world examples include Lazarus Group's FakeTLS, Cobalt Strike malleable C2 profiles, SUNBURST's OIP protocol masquerading, and Mustang Panda's PUBLOAD/StarProxy tools.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1001 Data Obfuscation
- Sub-technique
- T1001.003 Protocol or Service Impersonation
- Canonical reference
- https://attack.mitre.org/techniques/T1001/003/
Elastic Detection Query
sequence by host.name, process.entity_id with maxspan=24h
[network where event.type == "connection" and
destination.port in (443, 8443, 4443, 8080, 8888) and
not destination.ip : ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "192.168.*", "127.*") and
not process.name : ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "teams.exe", "slack.exe", "zoom.exe", "outlook.exe", "onedrive.exe") and
process.name : ("svchost.exe", "lsass.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "cscript.exe", "msbuild.exe", "installutil.exe", "regasm.exe", "regsvcs.exe", "certutil.exe", "bitsadmin.exe")]
[network where event.type == "connection" and
destination.port in (443, 8443, 4443, 8080, 8888) and
not destination.ip : ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "192.168.*", "127.*")]
[network where event.type == "connection" and
destination.port in (443, 8443, 4443, 8080, 8888) and
not destination.ip : ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "192.168.*", "127.*")]Detects protocol or service impersonation (T1001.003) by identifying suspicious processes making repeated outbound connections to TLS/HTTP ports commonly used by C2 frameworks to mimic legitimate traffic. Uses EQL sequence correlation to require at least 3 connections from the same process entity, filtering out known browsers and targeting LOLBins and living-off-the-land processes that have no legitimate reason to initiate TLS sessions.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software updaters using svchost.exe or rundll32.exe to check for updates over HTTPS may trigger this rule — verify against known software inventory and update schedules
- Security scanning tools or EDR agents running as system processes may make multiple outbound HTTPS connections for telemetry or signature updates — whitelist by process hash or parent process
- Custom enterprise applications built on .NET or WinHTTP that use generic process names like msbuild.exe as a host may legitimately connect to cloud APIs — validate against application deployment records
Other platforms for T1001.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FakeTLS Simulation: Raw TCP Connection on TLS Port
Expected signal: Sysmon Event ID 3: Network Connection with Image=powershell.exe, DestinationPort=4443, DestinationIp=127.0.0.1. Sysmon Event ID 1: Process Create with powershell.exe and TcpClient in CommandLine. The connection attempt will appear in network logs regardless of whether a listener exists.
- Test 2HTTP Header Manipulation: Cobalt Strike-Style Malleable C2 Simulation
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 1: Process Create showing powershell.exe with WebRequest in CommandLine. If proxy logs are available, the manipulated HTTP headers (fake User-Agent, encoded cookie) would be visible. PowerShell ScriptBlock Event ID 4104 captures the full script including the fake headers.
- Test 3DNS-Based Protocol Impersonation: DNS Tunneling Simulation
Expected signal: Sysmon Event ID 22: DNS Query events for each subdomain query (aGVsbG8.c2test.invalid, aG9zdG5hbWU.c2test.invalid, etc.) with Image=powershell.exe. Sysmon Event ID 1: Process Create for powershell.exe. Windows DNS Client event log may also capture the failed DNS resolutions. All queries will return NXDOMAIN.
- Test 4SUNBURST-Style Protocol Mimicry: Fake OIP Traffic Pattern
Expected signal: Sysmon Event ID 3: Three Network Connection events from powershell.exe to 127.0.0.1:8080 with distinct URIs. Sysmon Event ID 1: Process Create for powershell.exe. PowerShell ScriptBlock Event ID 4104: Full script content including OIP-mimicking User-Agent and custom X-Solarwinds-Request header. If a web proxy is in the traffic path, it would log the fake Orion User-Agent from a non-Orion process.
References (13)
- https://attack.mitre.org/techniques/T1001/003/
- https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/
- https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://www.mandiant.com/resources/cutting-edge-part-2
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133a
- https://www.novetta.com/2016/02/blockbuster/
- https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
- https://lab52.io/blog/mustang-panda-is-actively-targeting-europe-with-plugx-variants/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://github.com/activecm/rita
- https://zeek.org/
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-schema-tables
Unlock Pro Content
Get the full detection package for T1001.003 including response playbook, investigation guide, and atomic red team tests.