# T1071 - Application Layer Protocol

## SOC Recommendation
Investigate Application Layer Protocol activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Relay Pattern Analysis | Detect | Monitor for Relay Pattern Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Outbound Traffic Filtering | Isolate | Apply Outbound Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. [VirusTotal](https://virustotal.com) — malicious rating and community comments
2. [Shodan](https://shodan.io) — what services is the IP running? Common C2 ports open?
3. [AbuseIPDB](https://abuseipdb.com) — recent abuse reports
4. [AlienVault OTX](https://otx.alienvault.com) — known threat actor IOC?
5. Process running from %TEMP%, %APPDATA%, %PROGRAMDATA%, C:\Users\<user>\ (not standard app paths)
6. Process is unsigned or signed by an unfamiliar/suspicious vendor
7. Process name mimics a legitimate binary (e.g., svchos1.exe, svch0st.exe, iexplore.exe from wrong path)
8. Parent process is cmd.exe, powershell.exe, or an Office application (delivery chain indicator)

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block C2 IP and domain — MDE custom indicators (Block + Aler | Medium | No | Yes |
| Isolate device if beaconing process confirmed malicious | Medium | No | Yes |
| Submit process hash to Microsoft Defender Threat Intelligenc | Low | Yes | No |
| Run full malware scan on the affected device | Low | No | Yes |
| Check for persistence mechanisms installed by the beaconing | Low | Yes | No |
| Conduct memory forensics if process evades disk-based detect | Low | No | Yes |
| Search the same C2 across all customer environments | Low | No | Yes |

## KQL
```kql
let Exclusions = dynamic([
    "microsoft.com", "windowsupdate.com", "office.com", "live.com",
    "azure.com", "office365.com", "microsoftonline.com",
    "google.com", "gstatic.com", "googleapis.com",
    "akamai.com", "cloudflare.com", "fastly.net", "amazonaws.com",
    "apple.com", "icloud.com", "zoom.us", "webex.com", "teams.microsoft.com"
]);
DeviceNetworkEvents
| where TimeGenerated >= ago(2h)
| where ActionType == "ConnectionSuccess"
| where RemotePort in (80, 443, 8080, 8443, 4443)
| where not(RemoteUrl has_any (Exclusions))
| where not(RemoteIP has_any ("10.", "192.168.", "172.16.", "172.17.", "172.18.", "172.19.",
    "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.",
    "172.28.", "172.29.", "172.30.", "172.31."))
| sort by DeviceName asc, RemoteIP asc, TimeGenerated asc
| serialize
| extend PrevTime = prev(TimeGenerated, 1), PrevDevice = prev(DeviceName, 1), PrevRemoteIP = prev(RemoteIP, 1)
| where DeviceName == PrevDevice and RemoteIP == PrevRemoteIP
| extend IntervalSeconds = datetime_diff('second', TimeGenerated, PrevTime)
| where IntervalSeconds between (30 .. 3600)
| summarize
    ConnectionCount = count(),
    AvgIntervalSec = avg(IntervalSeconds),
    StdDevSec = stdev(IntervalSeconds),
    FirstConnection = min(TimeGenerated),
    LastConnection = max(TimeGenerated)
    by DeviceName, DeviceId, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| where ConnectionCount >= 8 and StdDevSec <= 30
| extend BeaconScore = round(100.0 - (StdDevSec / AvgIntervalSec * 100), 1)
| extend BeaconScore = iff(BeaconScore < 0, 0.0, BeaconScore)
| extend timestamp = LastConnection, HostCustomEntity = DeviceName, IPCustomEntity = RemoteIP
| order by BeaconScore desc
```
```kql
let TrustedDomains = dynamic([
    "microsoft.com", "windows.com", "office.com", "azure.com", "google.com",
    "amazonaws.com", "akamai.com", "cloudflare.com", "digicert.com"
]);
let Tunnelling = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "DnsQueryResponse"
    | where not(RemoteUrl has_any (TrustedDomains))
    | extend DomainLen = strlen(RemoteUrl)
    | where DomainLen > 50 or RemoteUrl matches regex @"[a-z0-9]{20,}\."
    | summarize QueryCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where QueryCount > 30
    | extend DetectionType = "DNS_Tunnelling"
);
let DGA = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "ConnectionFailed"
    | where not(RemoteUrl has_any (TrustedDomains))
    | summarize FailCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where FailCount > 100 and UniqueDomains > 50
    | extend DetectionType = "DGA_Pattern"
);
Tunnelling
| union DGA
| extend timestamp = now(), HostCustomEntity = DeviceName
| order by QueryCount desc
```
```kql
let runningRAT_parameters = dynamic(['/ui/chk', 'mactok=', 'UsRnMe=', 'IlocalP=', 'kMnD=']);
CommonSecurityLog
| where RequestMethod == "GET"
| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication
| where RequestURL has_any (runningRAT_parameters)
```

## Escalation Criteria
- Application Layer Protocol activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- NTP time synchronisation (port 123) — Already filtered by port — NTP is not included
- Telemetry agents (Splunk forwarder, Datadog agent) sending heartbeats — Add known agent destination IP/domain to the Exclusions list
- Video conferencing heartbeats (Teams, Zoom, Webex) — Pre-excluded in the Exclusions list — add any not covered
- Software update checkers — Add known update server domains to Exclusions list

Generated by SOC Response Atlas by Basyrix.