Detect Application Layer Protocol in CrowdStrike LogScale
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1071 Application Layer Protocol
- Canonical reference
- https://attack.mitre.org/techniques/T1071/
LogScale Detection Query
#event_simpleName=NetworkConnectIP4
| RemotePort in [80, 443, 53, 21, 25, 110, 143, 8080, 8443, 1883, 5222]
| !cidr(field=RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([ComputerName, ImageFileName, ContextProcessId], function=[
count(as=ConnectionCount),
min(field=@timestamp, as=FirstSeen),
max(field=@timestamp, as=LastSeen),
collect(field=RemotePort, as=Ports, limit=20),
count(field=RemoteAddressIP4, distinct=true, as=UniqueRemoteIPs)
])
| ConnectionCount > 10
| eval Duration := LastSeen - FirstSeen
| eval AvgIntervalMs := if(ConnectionCount > 1, Duration / (ConnectionCount - 1), 0)
| AvgIntervalMs > 1000 AND AvgIntervalMs < 3600000
| eval BeaconScore := if(
(AvgIntervalMs >= 55000 AND AvgIntervalMs <= 65000) OR
(AvgIntervalMs >= 295000 AND AvgIntervalMs <= 305000) OR
(AvgIntervalMs >= 895000 AND AvgIntervalMs <= 905000),
"high",
"medium")
| sort(field=ConnectionCount, order=desc)Detects C2 beaconing over application layer protocols using CrowdStrike Falcon sensor NetworkConnectIP4 telemetry in LogScale. Groups outbound connections to external IPs by host, executable image path, and process ID. Computes average inter-connection interval from LogScale's millisecond-precision @timestamp field. Flags processes with more than 10 external connections on common protocol ports with intervals between 1 second and 1 hour. Beacon score is HIGH for intervals matching 60s, 300s, or 900s C2 sleep patterns common in Cobalt Strike, Metasploit, and commodity RATs.
Data Sources
Required Tables
False Positives & Tuning
- The CrowdStrike Falcon sensor process itself (CSFalconService, falcond) and other EDR agents make regular check-ins to cloud infrastructure — whitelist known EDR process image paths in ImageFileName
- Software configuration management tools (Puppet agent, Chef client, Ansible pull mode) that poll controller nodes at configured run intervals over 443 or 8443 match both the connection count and scored interval thresholds
- Unified communications clients (Microsoft Teams, Zoom, Cisco Webex) maintaining persistent WebSocket or HTTPS keep-alive connections to CDN endpoints at near-regular heartbeat intervals, particularly on port 443 or 8443
Other platforms for T1071
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Multi-Protocol Beaconing Simulation
Expected signal: Sysmon for Linux Event ID 3 (Network Connection) showing curl processes connecting to 127.0.0.1 on ports 80, 443, 53. Firewall logs showing outbound connection attempts.
- Test 2IRC C2 Channel Simulation
Expected signal: Sysmon Event ID 3: Network Connection to port 6667 (IRC). Process creation event for nc/netcat with IRC protocol commands in arguments.
- Test 3HTTP Beaconing with Cobalt Strike User-Agent
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:80. Proxy logs showing repeated requests to /pixel.gif with suspicious User-Agent. Sysmon Event ID 1: PowerShell process creation for each iteration.
References (6)
- https://attack.mitre.org/techniques/T1071/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1071/T1071.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/network
Unlock Pro Content
Get the full detection package for T1071 including response playbook, investigation guide, and atomic red team tests.