T1071 IBM QRadar · QRadar

Detect Application Layer Protocol in IBM QRadar

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.

MITRE ATT&CK

Tactic
Command and Control
Technique
T1071 Application Layer Protocol
Canonical reference
https://attack.mitre.org/techniques/T1071/

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip,
       destinationip,
       destinationport,
       "userName",
       COUNT(*) AS ConnectionCount,
       MIN(starttime) AS FirstSeenEpochMs,
       MAX(starttime) AS LastSeenEpochMs,
       CASE
         WHEN COUNT(*) > 1
         THEN (MAX(LONG(starttime)) - MIN(LONG(starttime))) / (COUNT(*) - 1)
         ELSE 0
       END AS AvgIntervalMs
FROM events
WHERE starttime > (NOW() - 86400000)
  AND destinationport IN (80, 443, 53, 21, 25, 110, 143, 8080, 8443, 1883, 5222)
  AND eventdirection = 'L2R'
  AND NOT (destinationip ILIKE '10.%'
        OR destinationip ILIKE '172.16.%'
        OR destinationip ILIKE '172.17.%'
        OR destinationip ILIKE '172.18.%'
        OR destinationip ILIKE '172.19.%'
        OR destinationip ILIKE '172.20.%'
        OR destinationip ILIKE '172.21.%'
        OR destinationip ILIKE '172.22.%'
        OR destinationip ILIKE '172.23.%'
        OR destinationip ILIKE '172.24.%'
        OR destinationip ILIKE '172.25.%'
        OR destinationip ILIKE '172.26.%'
        OR destinationip ILIKE '172.27.%'
        OR destinationip ILIKE '172.28.%'
        OR destinationip ILIKE '172.29.%'
        OR destinationip ILIKE '172.30.%'
        OR destinationip ILIKE '172.31.%'
        OR destinationip ILIKE '192.168.%'
        OR destinationip ILIKE '127.%')
GROUP BY sourceip, destinationip, destinationport, "userName"
HAVING COUNT(*) > 10
   AND AvgIntervalMs BETWEEN 1000 AND 3600000
ORDER BY ConnectionCount DESC
high severity medium confidence

Detects hosts making more than 10 outbound connections to the same external destination IP and port within 24 hours, with an average inter-connection interval between 1 second and 1 hour — consistent with automated C2 beaconing over application layer protocols. AvgIntervalMs is derived from QRadar's millisecond-resolution starttime field. eventdirection='L2R' limits scope to local-to-remote traffic only.

Data Sources

QRadar Network Activity (firewall, proxy, IDS log sources)Palo Alto PAN-OSCisco ASACheck Point

Required Tables

events

False Positives & Tuning

  • CDN health-check probes and load balancer keep-alives from internal application servers to external monitoring endpoints generate repetitive outbound connections with sub-minute fixed intervals
  • VoIP and SIP clients making regular registration refresh messages to external SIP providers, often tunnelled over TCP 443 or 5060, may exhibit sub-60-second average intervals
  • IoT and OT devices with telemetry callbacks to cloud platforms (AWS IoT Core over MQTT 8883, generic MQTT 1883) at fixed polling cadences match the connection count and interval thresholds

Other platforms for T1071

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Multi-Protocol Beaconing Simulation

    Expected signal: Sysmon for Linux Event ID 3 (Network Connection) showing curl processes connecting to 127.0.0.1 on ports 80, 443, 53. Firewall logs showing outbound connection attempts.

  2. Test 2 IRC C2 Channel Simulation

    Expected signal: Sysmon Event ID 3: Network Connection to port 6667 (IRC). Process creation event for nc/netcat with IRC protocol commands in arguments.

  3. Test 3 HTTP Beaconing with Cobalt Strike User-Agent

    Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:80. Proxy logs showing repeated requests to /pixel.gif with suspicious User-Agent. Sysmon Event ID 1: PowerShell process creation for each iteration.

Last updated: 2026-04-13 Research depth: deep
References (4)

Response Playbook

Triage

  1. Identify the process initiating the connections — is it a known system binary, legitimate application, or suspicious/unknown executable?
  2. Examine the connection pattern — are connections regular (fixed intervals) or jittered? C2 frameworks often add jitter to avoid detection
  3. Check the remote IP reputation using threat intelligence feeds (VirusTotal, AbuseIPDB, OTX) and geolocation data
  4. Review the protocol and port combination — is the traffic on expected ports for that protocol? Look for protocol misuse (e.g., HTTP tunneling over port 53)
  5. Check if the process has a valid digital signature and whether its parent process chain is legitimate
  6. Correlate with DNS logs to identify the domain associated with the remote IP

Containment

  1. If confirmed C2: immediately isolate the endpoint using EDR network isolation or VLAN quarantine
  2. Block the identified C2 IP addresses and domains at the firewall and DNS level
  3. If lateral movement is suspected: isolate all potentially compromised hosts and reset affected credentials
  4. Disable any compromised service accounts and revoke OAuth/API tokens
  5. Create temporary firewall rules to block the specific port/protocol combination used by the C2 channel

Evidence Collection

  1. Full PCAP of the suspicious network connections for protocol-level analysis
  2. Process memory dump of the initiating process for malware analysis
  3. Sysmon Event ID 3 (Network Connection) logs with full process context
  4. DNS query logs correlated with connection timestamps
  5. Proxy/firewall logs showing full URL paths and HTTP headers if applicable
  6. Endpoint process tree showing parent-child relationships of the suspicious process

Escalation Criteria

  • !Beaconing pattern matches known C2 framework signatures (e.g., 60s Cobalt Strike default sleep)
  • !Multiple endpoints beaconing to the same external IP or domain
  • !Process associated with the connections is unsigned, recently dropped, or has been tampered with
  • !Evidence of data exfiltration (large outbound data volumes during beacon windows)
  • !The connection uses non-standard protocol/port combinations (e.g., DNS traffic not to port 53, or HTTP to high ports)

Investigation Guide

Related Techniques

T1071.001 — Web Protocols (HTTP/HTTPS C2)T1071.002 — File Transfer Protocols (FTP/SMB C2)T1071.003 — Mail Protocols (SMTP/IMAP C2)T1071.004 — DNS (DNS tunneling C2)T1071.005 — Publish/Subscribe Protocols (MQTT/XMPP C2)T1572 — Protocol TunnelingT1573 — Encrypted ChannelT1090 — ProxyT1132 — Data EncodingT1568 — Dynamic Resolution

Forensic Artifacts

  • >Network flow records (NetFlow/IPFIX) showing connection metadata
  • >Sysmon Event ID 3 — Network connection events with process context
  • >Windows Security Event ID 5156 — Windows Filtering Platform (WFP) permitted connections
  • >Proxy logs with full URL, User-Agent, and response codes
  • >DNS query logs showing domain resolution preceding network connections
  • >Firewall logs with action, bytes transferred, and session duration

Tuning Guidance

Start by baselining legitimate application layer protocol usage across your environment. Identify known update services, monitoring agents, and IoT devices that communicate on regular intervals. Create allowlists based on (source process + destination IP/domain + port) tuples rather than broad port exclusions. Adjust the beacon interval thresholds based on your environment's noise floor — environments with many IoT devices may need higher thresholds. Consider deploying JA3/JA3S fingerprinting for TLS connections to identify known C2 framework handshakes even when traffic is encrypted.

Hunting Queries

Hunt for processes making high volumes of outbound connections across multiple ports and IPs. Multi-protocol C2 frameworks often use fallback channels, switching between HTTP, DNS, and other protocols when one is blocked.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
| summarize ConnectionCount=count(), UniqueIPs=dcount(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName
| where ConnectionCount > 50
| where array_length(Ports) > 2
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=proxy OR index=firewall sourcetype IN ("stream:tcp", "pan:traffic") action=allowed NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*")
| stats count as ConnectionCount, dc(dest_ip) as UniqueIPs, values(dest_port) as Ports by src_ip, process_name
| where ConnectionCount > 50 AND mvcount(Ports) > 2
| sort - ConnectionCount

Hunt for connections to uncommon application layer protocol ports (MQTT 1883, XMPP 5222, AMQP 5672, STOMP 61613). These pub/sub and messaging protocols are increasingly abused for C2 due to low detection coverage in most environments.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where RemotePort in (1883, 5222, 5672, 61613)
| summarize ConnectionCount=count(), UniqueIPs=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, RemotePort
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=network sourcetype IN ("stream:tcp", "pan:traffic") dest_port IN (1883, 5222, 5672, 61613) action=allowed NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*")
| stats count as ConnectionCount, dc(dest_ip) as UniqueIPs by src_ip, process_name, dest_port
| sort - ConnectionCount

Hunt for extremely consistent connection patterns — processes making a nearly identical number of connections per hour over multiple days. A very low standard deviation in hourly connection counts indicates automated, programmatic communication typical of C2 rather than human-driven activity.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
| summarize Connections=count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| summarize HourlyAvg=avg(Connections), HourlyStdDev=stdev(Connections), TotalHours=count() by DeviceName, InitiatingProcessFileName
| where HourlyStdDev < 2 and TotalHours > 24
| sort by TotalHours desc
Hunting — SPL
spl 
index=proxy OR index=firewall sourcetype IN ("stream:tcp", "pan:traffic") action=allowed NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*")
| bin _time span=1h
| stats count as Connections by src_ip, process_name, _time
| stats avg(Connections) as HourlyAvg, stdev(Connections) as HourlyStdDev, count as TotalHours by src_ip, process_name
| where HourlyStdDev < 2 AND TotalHours > 24
| sort - TotalHours

Atomic Red Team Tests

Test 1 Multi-Protocol Beaconing Simulation
linux

Simulates C2 beaconing across multiple application layer protocols by making periodic outbound connections to localhost on common C2 ports (HTTP 80, HTTPS 443, DNS 53). This mimics the multi-protocol fallback behavior of advanced C2 frameworks like Cobalt Strike and Sliver.

Command

bash 
for port in 80 443 53; do for i in $(seq 1 5); do curl -s -o /dev/null --connect-timeout 2 http://127.0.0.1:$port/ 2>/dev/null; sleep 2; done; done

Expected Telemetry

Sysmon for Linux Event ID 3 (Network Connection) showing curl processes connecting to 127.0.0.1 on ports 80, 443, 53. Firewall logs showing outbound connection attempts.

Expected Detection

Alert fires on repeated connections at regular intervals across multiple ports from the same source process. BeaconScore should trigger based on consistent 2-second intervals.

Test 2 IRC C2 Channel Simulation
linux

Simulates malware connecting to an IRC server for C2 communications, as used by Hildegard, Magic Hound, Siloscape, and TeamTNT. Uses netcat to attempt a connection to a non-existent IRC server on the standard port.

Command

bash 
echo -e 'NICK testbot\nUSER testbot 0 * :test\nJOIN #c2channel\nPRIVMSG #c2channel :beacon' | nc -w 3 127.0.0.1 6667 2>/dev/null || true

Expected Telemetry

Sysmon Event ID 3: Network Connection to port 6667 (IRC). Process creation event for nc/netcat with IRC protocol commands in arguments.

Expected Detection

Network monitoring should flag outbound IRC connections (port 6667/6697) as anomalous. Alert fires on connection to known IRC port from a non-IRC client process.

Test 3 HTTP Beaconing with Cobalt Strike User-Agent
windows

Simulates HTTP-based C2 beaconing using a User-Agent string commonly associated with Cobalt Strike default malleable profiles. Makes 10 periodic HTTP GET requests at 5-second intervals to localhost.

Command

powershell 
for /L %i in (1,1,10) do (
  powershell -Command "Invoke-WebRequest -Uri 'http://127.0.0.1/pixel.gif' -UserAgent 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)' -ErrorAction SilentlyContinue" 2>nul
  timeout /t 5 /nobreak >nul
)

Expected Telemetry

Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:80. Proxy logs showing repeated requests to /pixel.gif with suspicious User-Agent. Sysmon Event ID 1: PowerShell process creation for each iteration.

Expected Detection

Alert fires on regular-interval HTTP connections from PowerShell. Proxy-based detections should flag the anomalous User-Agent string. BeaconScore=high due to consistent 5-second interval.

Related Detections

Tactic Hub

TA0011 Command and Control

Sub-techniques (5)

Related Techniques

T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.003 Mail Protocols T1071.004 DNS T1071.005 Publish/Subscribe Protocols T1572 Protocol Tunneling T1573 Encrypted Channel T1090 Proxy T1132 Data Encoding T1568 Dynamic Resolution

Same Tactic: Command and Control

Popular Detections