title: Publish/Subscribe Protocols (T1071.005)
id: df00tech-t1071-005
status: experimental
description: "Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as MQTT, XMPP, AMQP, and STOMP use a publish/subscribe design, with message distribution managed by a centralized broker. Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics. An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also mimicking normal, expected traffic."
references:
  - https://attack.mitre.org/techniques/T1071/005/
  - https://df00tech.com/detections/T1071.005
author: df00tech
date: 2026/04/13
tags:
  - attack.t1071.005
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: network_connection
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - "IoT platforms and home automation systems that legitimately use MQTT for device communication (Home Assistant, AWS IoT Core)"
  - "Chat and messaging applications using XMPP (Pidgin, Conversations, Cisco Jabber)"
  - "Message queue infrastructure (RabbitMQ, ActiveMQ, Apache Kafka) used for application integration"
  - Development and testing environments with MQTT brokers for IoT prototyping
level: high