Detect Application Layer Protocol in IBM QRadar
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1071 Application Layer Protocol
- Canonical reference
- https://attack.mitre.org/techniques/T1071/
QRadar Detection Query
SELECT sourceip,
destinationip,
destinationport,
"userName",
COUNT(*) AS ConnectionCount,
MIN(starttime) AS FirstSeenEpochMs,
MAX(starttime) AS LastSeenEpochMs,
CASE
WHEN COUNT(*) > 1
THEN (MAX(LONG(starttime)) - MIN(LONG(starttime))) / (COUNT(*) - 1)
ELSE 0
END AS AvgIntervalMs
FROM events
WHERE starttime > (NOW() - 86400000)
AND destinationport IN (80, 443, 53, 21, 25, 110, 143, 8080, 8443, 1883, 5222)
AND eventdirection = 'L2R'
AND NOT (destinationip ILIKE '10.%'
OR destinationip ILIKE '172.16.%'
OR destinationip ILIKE '172.17.%'
OR destinationip ILIKE '172.18.%'
OR destinationip ILIKE '172.19.%'
OR destinationip ILIKE '172.20.%'
OR destinationip ILIKE '172.21.%'
OR destinationip ILIKE '172.22.%'
OR destinationip ILIKE '172.23.%'
OR destinationip ILIKE '172.24.%'
OR destinationip ILIKE '172.25.%'
OR destinationip ILIKE '172.26.%'
OR destinationip ILIKE '172.27.%'
OR destinationip ILIKE '172.28.%'
OR destinationip ILIKE '172.29.%'
OR destinationip ILIKE '172.30.%'
OR destinationip ILIKE '172.31.%'
OR destinationip ILIKE '192.168.%'
OR destinationip ILIKE '127.%')
GROUP BY sourceip, destinationip, destinationport, "userName"
HAVING COUNT(*) > 10
AND AvgIntervalMs BETWEEN 1000 AND 3600000
ORDER BY ConnectionCount DESCDetects hosts making more than 10 outbound connections to the same external destination IP and port within 24 hours, with an average inter-connection interval between 1 second and 1 hour — consistent with automated C2 beaconing over application layer protocols. AvgIntervalMs is derived from QRadar's millisecond-resolution starttime field. eventdirection='L2R' limits scope to local-to-remote traffic only.
Data Sources
Required Tables
False Positives & Tuning
- CDN health-check probes and load balancer keep-alives from internal application servers to external monitoring endpoints generate repetitive outbound connections with sub-minute fixed intervals
- VoIP and SIP clients making regular registration refresh messages to external SIP providers, often tunnelled over TCP 443 or 5060, may exhibit sub-60-second average intervals
- IoT and OT devices with telemetry callbacks to cloud platforms (AWS IoT Core over MQTT 8883, generic MQTT 1883) at fixed polling cadences match the connection count and interval thresholds
Other platforms for T1071
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Multi-Protocol Beaconing Simulation
Expected signal: Sysmon for Linux Event ID 3 (Network Connection) showing curl processes connecting to 127.0.0.1 on ports 80, 443, 53. Firewall logs showing outbound connection attempts.
- Test 2IRC C2 Channel Simulation
Expected signal: Sysmon Event ID 3: Network Connection to port 6667 (IRC). Process creation event for nc/netcat with IRC protocol commands in arguments.
- Test 3HTTP Beaconing with Cobalt Strike User-Agent
Expected signal: Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:80. Proxy logs showing repeated requests to /pixel.gif with suspicious User-Agent. Sysmon Event ID 1: PowerShell process creation for each iteration.
References (6)
- https://attack.mitre.org/techniques/T1071/
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1071/T1071.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/network
Unlock Pro Content
Get the full detection package for T1071 including response playbook, investigation guide, and atomic red team tests.