Detect Application Layer Protocol in Google Chronicle
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1071 Application Layer Protocol
- Canonical reference
- https://attack.mitre.org/techniques/T1071/
YARA-L Detection Query
rule t1071_application_layer_protocol_beaconing {
meta:
author = "Argus Detection Engineering"
description = "Detects C2 beaconing over application layer protocols (T1071). Identifies processes making more than 10 outbound network connections to non-RFC1918 IPs on common protocol ports within a 1-hour match window."
mitre_attack_tactic = "Command and Control"
mitre_attack_technique = "T1071"
reference = "https://attack.mitre.org/techniques/T1071/"
severity = "HIGH"
confidence = "MEDIUM"
version = "1.0"
events:
$e.metadata.event_type = "NETWORK_CONNECTION"
$e.network.direction = "OUTBOUND"
$e.target.port in (80, 443, 53, 21, 25, 110, 143, 8080, 8443, 1883, 5222)
not re.regex($e.target.ip, `^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)`)
$e.principal.process.file.full_path != ""
$hostname = $e.principal.hostname
$process_path = $e.principal.process.file.full_path
match:
$hostname, $process_path over 1h
outcome:
$connection_count = count($e.metadata.id)
$unique_dest_ips = count_distinct($e.target.ip)
$dest_ports = array_distinct($e.target.port)
$first_seen = min($e.metadata.event_timestamp.seconds)
$last_seen = max($e.metadata.event_timestamp.seconds)
$risk_score = max(if($e.target.port = 1883 or $e.target.port = 5222, 85, 60))
condition:
#e > 10
}YARA-L 2.0 rule for Google Chronicle UDM that detects processes on a host making more than 10 outbound network connections to non-RFC1918 IP addresses on application layer protocol ports within a 1-hour match window. Groups events by hostname and process file path. Risk score is elevated for MQTT (1883) and XMPP (5222) which are uncommon in standard enterprise egress. The #e > 10 condition counts distinct event matches against the $e variable within the match window.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate recursive DNS resolvers or DNS forwarder appliances on the network making high volumes of outbound port 53 connections will match if not excluded by principal.hostname or IP allowlist
- Email security gateways making repeated outbound connections on SMTP (25), IMAP (143), or POP3 (110) to external mail exchange servers for relay and delivery
- Industrial IoT sensors using MQTT (1883) or XMPP (5222) for cloud telemetry publishing at fixed intervals — these are expected in OT network segments and should be excluded by network zone
Other platforms for T1071
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Multi-Protocol Beaconing Simulation
Expected signal: Sysmon for Linux Event ID 3 (Network Connection) showing curl processes connecting to 127.0.0.1 on ports 80, 443, 53. Firewall logs showing outbound connection attempts.
- Test 2IRC C2 Channel Simulation
Expected signal: Sysmon Event ID 3: Network Connection to port 6667 (IRC). Process creation event for nc/netcat with IRC protocol commands in arguments.
- Test 3HTTP Beaconing with Cobalt Strike User-Agent
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:80. Proxy logs showing repeated requests to /pixel.gif with suspicious User-Agent. Sysmon Event ID 1: PowerShell process creation for each iteration.
References (6)
- https://attack.mitre.org/techniques/T1071/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1071/T1071.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/network
Unlock Pro Content
Get the full detection package for T1071 including response playbook, investigation guide, and atomic red team tests.