Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0027 — Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
DET0027

Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets

5 analytic(s) · 1 technique(s) detected

Analytics

5
AN0075 Analytic 0075
Windows

Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

NSM:Flow http.log, ssl.log WinEventLog:Sysmon EventCode=3, 22
[ProcessNameExclusions] Filter out legitimate browser/network utilities
[UserAgentAnomalies] Detect non-browser user-agents or spoofed headers
[OutboundByteRatioThreshold] Flag when outbound > inbound volume by 90%+
AN0076 Analytic 0076
Linux

Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

NSM:Flow http.log, conn.log auditd:SYSCALL execve
[CommandLinePatternMatch] curl or wget in scripts with suspicious domains or silent flags
[BeaconIntervalWindow] Fixed-timed HTTP callbacks with 60±5s jitter
AN0077 Analytic 0077
macOS

Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

macos:osquery socket_events macos:unifiedlog log stream --predicate
[SuspiciousParentProcess] Non-browser parent of web traffic (e.g., AppleScript, bash)
[URIEntropyThreshold] Unusually encoded data in GET/POST URIs
AN0078 Analytic 0078
ESXi

Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

NSM:Flow SPAN or port-mirrored HTTP/S esxi:shell /root/.ash_history or /etc/init.d/*
[ShellScriptMatch] Match on commands like `wget https://*`, `curl -s`
[ExternalConnectionFilter] Public IPs or external DNS hostnames
AN0079 Analytic 0079
Network Devices

Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

NSM:Flow http.log, ssl.log, websocket.log
[HeaderEncodingPattern] Base64, hex, or UTF-16 encoding in URI, cookie, or host
[TLSFingerprintMismatch] JA3 hash deviation from known clients

Detected Techniques

1

Command & Control (1)

Details

MITRE ID
DET0027
STIX ID
x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc
Analytics
5
Techniques Detected
1
By Tactic
Command & Control
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.