Detect Protocol or Service Impersonation in Microsoft Sentinel
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By mimicking legitimate protocols or web services, adversaries make their C2 traffic blend in with normal network traffic. Techniques include FakeTLS (malformed TLS handshakes that mimic real TLS but use different encryption), custom HTTP header manipulation, URI endpoint spoofing, SSL certificate impersonation, and mimicking well-known services like Gmail or Google Drive. Real-world examples include Lazarus Group's FakeTLS, Cobalt Strike malleable C2 profiles, SUNBURST's OIP protocol masquerading, and Mustang Panda's PUBLOAD/StarProxy tools.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1001 Data Obfuscation
- Sub-technique
- T1001.003 Protocol or Service Impersonation
- Canonical reference
- https://attack.mitre.org/techniques/T1001/003/
KQL Detection Query
let FakeTLSPorts = dynamic([443, 8443, 4443, 8080, 8888]);
let SuspiciousUserAgents = dynamic([
"Mozilla/4.0", "Mozilla/3.0", "MSIE",
"WinHttp", "curl/7.1", "Python/2", "Go-http-client/1.1"
]);
let KnownC2Headers = dynamic([
"DSID", "X-Session-Id", "X-Request-Id",
"Authorization: Basic", "Cookie: session=",
"X-Forwarded-For"
]);
// Detection 1: TLS on non-standard ports (potential FakeTLS)
let FakeTLSBeacon = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (FakeTLSPorts)
| where RemoteIPType == "Public"
| where not(InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "teams.exe", "slack.exe", "zoom.exe", "outlook.exe", "onedrive.exe", "svchost.exe"))
| summarize ConnectionCount=count(), BytesSent=sum(SentBytes), BytesReceived=sum(ReceivedBytes),
UniqueRemoteIPs=dcount(RemoteIP), Ports=make_set(RemotePort),
FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId
| where ConnectionCount >= 3 or BytesSent > 50000
| extend BeaconInterval = datetime_diff('minute', LastSeen, FirstSeen)
| extend SuspicionReason = "TLS-port-non-browser-process";
// Detection 2: HTTP traffic mimicking known services with anomalous patterns
let AnomalousHTTP = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (80, 443, 8080, 8443)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName in~ ("svchost.exe", "lsass.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "cscript.exe", "msbuild.exe", "installutil.exe", "regasm.exe", "regsvcs.exe")
| summarize ConnectionCount=count(), UniqueRemoteIPs=dcount(RemoteIP),
BytesSent=sum(SentBytes), BytesReceived=sum(ReceivedBytes),
FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId
| where ConnectionCount >= 2
| extend SuspicionReason = "HTTP-from-suspicious-process";
// Detection 3: Beaconing pattern - regular interval connections
let BeaconingPattern = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIPType == "Public"
| where not(InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "teams.exe", "slack.exe", "zoom.exe", "outlook.exe", "onedrive.exe", "svchost.exe", "MsMpEng.exe"))
| summarize ConnectionTimes=make_list(Timestamp), ConnectionCount=count(),
UniqueRemoteIPs=dcount(RemoteIP), BytesSent=sum(SentBytes)
by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| where ConnectionCount between (5 .. 200)
| extend TimeDiffs = series_subtract(array_slice(ConnectionTimes, 1, -1), array_slice(ConnectionTimes, 0, -2))
| extend AvgIntervalMs = todouble(array_sum(TimeDiffs)) / array_length(TimeDiffs)
| extend StdDevInterval = series_stats_dynamic(TimeDiffs)["stdev"]
| where AvgIntervalMs > 0 and todouble(StdDevInterval) / AvgIntervalMs < 0.30
| extend SuspicionReason = "regular-beaconing-interval";
// Union results
FakeTLSBeacon
| union AnomalousHTTP
| project Timestamp=FirstSeen, DeviceName, InitiatingProcessFileName,
InitiatingProcessCommandLine, ConnectionCount, UniqueRemoteIPs,
BytesSent, BytesReceived, SuspicionReason
| sort by Timestamp descDetects protocol or service impersonation C2 activity using Microsoft Defender for Endpoint network telemetry. Combines three detection patterns: (1) non-browser processes making TLS-port connections suggesting FakeTLS, (2) suspicious system processes initiating outbound HTTP/HTTPS connections, and (3) statistical beaconing pattern detection based on regular connection intervals with low standard deviation. Designed to surface Lazarus FakeTLS, Cobalt Strike malleable C2, PUBLOAD, and similar threats.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate monitoring agents (Datadog, SolarWinds, Nagios) that beacon on regular intervals to their management servers
- Application performance monitoring tools making regular HTTP health checks from svchost-hosted services
- Custom internal applications using non-standard TLS ports for internal API communications
- Software update mechanisms in enterprise software (Java, Adobe, etc.) making regular check-in connections
Other platforms for T1001.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FakeTLS Simulation: Raw TCP Connection on TLS Port
Expected signal: Sysmon Event ID 3: Network Connection with Image=powershell.exe, DestinationPort=4443, DestinationIp=127.0.0.1. Sysmon Event ID 1: Process Create with powershell.exe and TcpClient in CommandLine. The connection attempt will appear in network logs regardless of whether a listener exists.
- Test 2HTTP Header Manipulation: Cobalt Strike-Style Malleable C2 Simulation
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 1: Process Create showing powershell.exe with WebRequest in CommandLine. If proxy logs are available, the manipulated HTTP headers (fake User-Agent, encoded cookie) would be visible. PowerShell ScriptBlock Event ID 4104 captures the full script including the fake headers.
- Test 3DNS-Based Protocol Impersonation: DNS Tunneling Simulation
Expected signal: Sysmon Event ID 22: DNS Query events for each subdomain query (aGVsbG8.c2test.invalid, aG9zdG5hbWU.c2test.invalid, etc.) with Image=powershell.exe. Sysmon Event ID 1: Process Create for powershell.exe. Windows DNS Client event log may also capture the failed DNS resolutions. All queries will return NXDOMAIN.
- Test 4SUNBURST-Style Protocol Mimicry: Fake OIP Traffic Pattern
Expected signal: Sysmon Event ID 3: Three Network Connection events from powershell.exe to 127.0.0.1:8080 with distinct URIs. Sysmon Event ID 1: Process Create for powershell.exe. PowerShell ScriptBlock Event ID 4104: Full script content including OIP-mimicking User-Agent and custom X-Solarwinds-Request header. If a web proxy is in the traffic path, it would log the fake Orion User-Agent from a non-Orion process.
References (13)
- https://attack.mitre.org/techniques/T1001/003/
- https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/
- https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://www.mandiant.com/resources/cutting-edge-part-2
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133a
- https://www.novetta.com/2016/02/blockbuster/
- https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
- https://lab52.io/blog/mustang-panda-is-actively-targeting-europe-with-plugx-variants/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://github.com/activecm/rita
- https://zeek.org/
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-schema-tables
Unlock Pro Content
Get the full detection package for T1001.003 including response playbook, investigation guide, and atomic red team tests.