Command and Control

T1071 — Application Layer Protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing...

Investigate Application Layer Protocol activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

Platforms

Linux, macOS, Windows, Network Devices, ESXi

Priority / status

high / complete

Evidence to collect

Host or resource affected
Account or identity involved
Timestamp of the activity
Related process, file, or network artifact
Any preceding or follow-on alerts

ATT&CK Technique	D3FEND Technique	Practical SOC Action	Tooling
T1071 Application Layer Protocol	Relay Pattern Analysis	Monitor for Relay Pattern Analysis indicators relevant to this technique.	Defender for Endpoint
T1071 Application Layer Protocol	File Encryption	Apply File Encryption to reduce this technique's viability before an incident occurs.	Defender for Endpoint
T1071 Application Layer Protocol	File Eviction	Use File Eviction to remove the adversary's foothold once this technique is confirmed.	Defender for Endpoint
T1071 Application Layer Protocol	Outbound Traffic Filtering	Apply Outbound Traffic Filtering to contain the blast radius once this technique is observed.	Sentinel, Defender for Endpoint

T1071 Application Layer Protocol → D3FEND → SOC action

Investigation steps — Microsoft

[VirusTotal](https://virustotal.com) — malicious rating and community comments
[Shodan](https://shodan.io) — what services is the IP running? Common C2 ports open?
[AbuseIPDB](https://abuseipdb.com) — recent abuse reports
[AlienVault OTX](https://otx.alienvault.com) — known threat actor IOC?
Process running from %TEMP%, %APPDATA%, %PROGRAMDATA%, C:\Users\<user>\ (not standard app paths)
Process is unsigned or signed by an unfamiliar/suspicious vendor
Process name mimics a legitimate binary (e.g., svchos1.exe, svch0st.exe, iexplore.exe from wrong path)
Parent process is cmd.exe, powershell.exe, or an Office application (delivery chain indicator)

Investigation steps — generic

Confirm whether the observed application layer protocol activity matches expected administrative or application behaviour.
Identify the host, account, or resource where the activity occurred and its business criticality.
Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.
Real detection reference: "C2 Beaconing Pattern" -- Flags periodic outbound connections from a host to the same external destination with low timing jitter, the statistical signature of C2 beaconing.

Response actions

Action	Risk	Automation safe	Approval required
Block C2 IP and domain — MDE custom indicators (Block + Aler	Medium	No	Yes
Isolate device if beaconing process confirmed malicious	Medium	No	Yes
Submit process hash to Microsoft Defender Threat Intelligenc	Low	Yes	No
Run full malware scan on the affected device	Low	No	Yes
Check for persistence mechanisms installed by the beaconing	Low	Yes	No
Conduct memory forensics if process evades disk-based detect	Low	No	Yes
Search the same C2 across all customer environments	Low	No	Yes

KQL

GEN-CC-001 — C2 Beaconing Pattern

let Exclusions = dynamic([
    "microsoft.com", "windowsupdate.com", "office.com", "live.com",
    "azure.com", "office365.com", "microsoftonline.com",
    "google.com", "gstatic.com", "googleapis.com",
    "akamai.com", "cloudflare.com", "fastly.net", "amazonaws.com",
    "apple.com", "icloud.com", "zoom.us", "webex.com", "teams.microsoft.com"
]);
DeviceNetworkEvents
| where TimeGenerated >= ago(2h)
| where ActionType == "ConnectionSuccess"
| where RemotePort in (80, 443, 8080, 8443, 4443)
| where not(RemoteUrl has_any (Exclusions))
| where not(RemoteIP has_any ("10.", "192.168.", "172.16.", "172.17.", "172.18.", "172.19.",
    "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.",
    "172.28.", "172.29.", "172.30.", "172.31."))
| sort by DeviceName asc, RemoteIP asc, TimeGenerated asc
| serialize
| extend PrevTime = prev(TimeGenerated, 1), PrevDevice = prev(DeviceName, 1), PrevRemoteIP = prev(RemoteIP, 1)
| where DeviceName == PrevDevice and RemoteIP == PrevRemoteIP
| extend IntervalSeconds = datetime_diff('second', TimeGenerated, PrevTime)
| where IntervalSeconds between (30 .. 3600)
| summarize
    ConnectionCount = count(),
    AvgIntervalSec = avg(IntervalSeconds),
    StdDevSec = stdev(IntervalSeconds),
    FirstConnection = min(TimeGenerated),
    LastConnection = max(TimeGenerated)
    by DeviceName, DeviceId, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| where ConnectionCount >= 8 and StdDevSec <= 30
| extend BeaconScore = round(100.0 - (StdDevSec / AvgIntervalSec * 100), 1)
| extend BeaconScore = iff(BeaconScore < 0, 0.0, BeaconScore)
| extend timestamp = LastConnection, HostCustomEntity = DeviceName, IPCustomEntity = RemoteIP
| order by BeaconScore desc

GEN-CC-002 — DNS Tunnelling and DGA

let TrustedDomains = dynamic([
    "microsoft.com", "windows.com", "office.com", "azure.com", "google.com",
    "amazonaws.com", "akamai.com", "cloudflare.com", "digicert.com"
]);
let Tunnelling = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "DnsQueryResponse"
    | where not(RemoteUrl has_any (TrustedDomains))
    | extend DomainLen = strlen(RemoteUrl)
    | where DomainLen > 50 or RemoteUrl matches regex @"[a-z0-9]{20,}\."
    | summarize QueryCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where QueryCount > 30
    | extend DetectionType = "DNS_Tunnelling"
);
let DGA = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "ConnectionFailed"
    | where not(RemoteUrl has_any (TrustedDomains))
    | summarize FailCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where FailCount > 100 and UniqueDomains > 50
    | extend DetectionType = "DGA_Pattern"
);
Tunnelling
| union DGA
| extend timestamp = now(), HostCustomEntity = DeviceName
| order by QueryCount desc

baedfdf4-7cc8-45a1-81a9-065821628b83 — RunningRAT request parameters

let runningRAT_parameters = dynamic(['/ui/chk', 'mactok=', 'UsRnMe=', 'IlocalP=', 'kMnD=']);
CommonSecurityLog
| where RequestMethod == "GET"
| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication
| where RequestURL has_any (runningRAT_parameters)

Escalation criteria

Application Layer Protocol activity observed on a privileged account or critical system.
Activity follows or precedes other suspicious behaviour in the same investigation.
Automated triage cannot confidently rule out malicious intent.

False positive considerations

NTP time synchronisation (port 123) — Already filtered by port — NTP is not included
Telemetry agents (Splunk forwarder, Datadog agent) sending heartbeats — Add known agent destination IP/domain to the Exclusions list
Video conferencing heartbeats (Teams, Zoom, Webex) — Pre-excluded in the Exclusions list — add any not covered
Software update checkers — Add known update server domains to Exclusions list

View Markdown Download Markdown

# T1071 - Application Layer Protocol

## SOC Recommendation
Investigate Application Layer Protocol activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Relay Pattern Analysis | Detect | Monitor for Relay Pattern Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Outbound Traffic Filtering | Isolate | Apply Outbound Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. [VirusTotal](https://virustotal.com) — malicious rating and community comments
2. [Shodan](https://shodan.io) — what services is the IP running? Common C2 ports open?
3. [AbuseIPDB](https://abuseipdb.com) — recent abuse reports
4. [AlienVault OTX](https://otx.alienvault.com) — known threat actor IOC?
5. Process running from %TEMP%, %APPDATA%, %PROGRAMDATA%, C:\Users\<user>\ (not standard app paths)
6. Process is unsigned or signed by an unfamiliar/suspicious vendor
7. Process name mimics a legitimate binary (e.g., svchos1.exe, svch0st.exe, iexplore.exe from wrong path)
8. Parent process is cmd.exe, powershell.exe, or an Office application (delivery chain indicator)

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block C2 IP and domain — MDE custom indicators (Block + Aler | Medium | No | Yes |
| Isolate device if beaconing process confirmed malicious | Medium | No | Yes |
| Submit process hash to Microsoft Defender Threat Intelligenc | Low | Yes | No |
| Run full malware scan on the affected device | Low | No | Yes |
| Check for persistence mechanisms installed by the beaconing | Low | Yes | No |
| Conduct memory forensics if process evades disk-based detect | Low | No | Yes |
| Search the same C2 across all customer environments | Low | No | Yes |

## KQL
```kql
let Exclusions = dynamic([
    "microsoft.com", "windowsupdate.com", "office.com", "live.com",
    "azure.com", "office365.com", "microsoftonline.com",
    "google.com", "gstatic.com", "googleapis.com",
    "akamai.com", "cloudflare.com", "fastly.net", "amazonaws.com",
    "apple.com", "icloud.com", "zoom.us", "webex.com", "teams.microsoft.com"
]);
DeviceNetworkEvents
| where TimeGenerated >= ago(2h)
| where ActionType == "ConnectionSuccess"
| where RemotePort in (80, 443, 8080, 8443, 4443)
| where not(RemoteUrl has_any (Exclusions))
| where not(RemoteIP has_any ("10.", "192.168.", "172.16.", "172.17.", "172.18.", "172.19.",
    "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.",
    "172.28.", "172.29.", "172.30.", "172.31."))
| sort by DeviceName asc, RemoteIP asc, TimeGenerated asc
| serialize
| extend PrevTime = prev(TimeGenerated, 1), PrevDevice = prev(DeviceName, 1), PrevRemoteIP = prev(RemoteIP, 1)
| where DeviceName == PrevDevice and RemoteIP == PrevRemoteIP
| extend IntervalSeconds = datetime_diff('second', TimeGenerated, PrevTime)
| where IntervalSeconds between (30 .. 3600)
| summarize
    ConnectionCount = count(),
    AvgIntervalSec = avg(IntervalSeconds),
    StdDevSec = stdev(IntervalSeconds),
    FirstConnection = min(TimeGenerated),
    LastConnection = max(TimeGenerated)
    by DeviceName, DeviceId, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| where ConnectionCount >= 8 and StdDevSec <= 30
| extend BeaconScore = round(100.0 - (StdDevSec / AvgIntervalSec * 100), 1)
| extend BeaconScore = iff(BeaconScore < 0, 0.0, BeaconScore)
| extend timestamp = LastConnection, HostCustomEntity = DeviceName, IPCustomEntity = RemoteIP
| order by BeaconScore desc
```
```kql
let TrustedDomains = dynamic([
    "microsoft.com", "windows.com", "office.com", "azure.com", "google.com",
    "amazonaws.com", "akamai.com", "cloudflare.com", "digicert.com"
]);
let Tunnelling = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "DnsQueryResponse"
    | where not(RemoteUrl has_any (TrustedDomains))
    | extend DomainLen = strlen(RemoteUrl)
    | where DomainLen > 50 or RemoteUrl matches regex @"[a-z0-9]{20,}\."
    | summarize QueryCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where QueryCount > 30
    | extend DetectionType = "DNS_Tunnelling"
);
let DGA = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "ConnectionFailed"
    | where not(RemoteUrl has_any (TrustedDomains))
    | summarize FailCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where FailCount > 100 and UniqueDomains > 50
    | extend DetectionType = "DGA_Pattern"
);
Tunnelling
| union DGA
| extend timestamp = now(), HostCustomEntity = DeviceName
| order by QueryCount desc
```
```kql
let runningRAT_parameters = dynamic(['/ui/chk', 'mactok=', 'UsRnMe=', 'IlocalP=', 'kMnD=']);
CommonSecurityLog
| where RequestMethod == "GET"
| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication
| where RequestURL has_any (runningRAT_parameters)
```

## Escalation Criteria
- Application Layer Protocol activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- NTP time synchronisation (port 123) — Already filtered by port — NTP is not included
- Telemetry agents (Splunk forwarder, Datadog agent) sending heartbeats — Add known agent destination IP/domain to the Exclusions list
- Video conferencing heartbeats (Teams, Zoom, Webex) — Pre-excluded in the Exclusions list — add any not covered
- Software update checkers — Add known update server domains to Exclusions list

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1071.json

Response:

{
  "technique_id": "T1071",
  "name": "Application Layer Protocol",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Command and Control"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows",
    "Network Devices",
    "ESXi"
  ],
  "summary": "Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing...",
  "soc_recommendation": "Investigate Application Layer Protocol activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-RPA",
      "name": "Relay Pattern Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Relay Pattern Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-OTF",
      "name": "Outbound Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Outbound Traffic Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "[VirusTotal](https://virustotal.com) — malicious rating and community comments",
      "[Shodan](https://shodan.io) — what services is the IP running? Common C2 ports open?",
      "[AbuseIPDB](https://abuseipdb.com) — recent abuse reports",
      "[AlienVault OTX](https://otx.alienvault.com) — known threat actor IOC?",
      "Process running from %TEMP%, %APPDATA%, %PROGRAMDATA%, C:\\Users\\<user>\\ (not standard app paths)",
      "Process is unsigned or signed by an unfamiliar/suspicious vendor",
      "Process name mimics a legitimate binary (e.g., svchos1.exe, svch0st.exe, iexplore.exe from wrong path)",
      "Parent process is cmd.exe, powershell.exe, or an Office application (delivery chain indicator)"
    ],
    "generic": [
      "Confirm whether the observed application layer protocol activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"C2 Beaconing Pattern\" -- Flags periodic outbound connections from a host to the same external destination with low timing jitter, the statistical signature of C2 beaconing."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Block C2 IP and domain — MDE custom indicators (Block + Aler",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint",
      "notes": "Block C2 IP and domain — MDE custom indicators (Block + Alert) + firewall + Sentinel TI watchlist"
    },
    {
      "name": "Isolate device if beaconing process confirmed malicious",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Submit process hash to Microsoft Defender Threat Intelligenc",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Submit process hash to Microsoft Defender Threat Intelligence sandbox"
    },
    {
      "name": "Run full malware scan on the affected device",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Check for persistence mechanisms installed by the beaconing",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Check for persistence mechanisms installed by the beaconing process"
    },
    {
      "name": "Conduct memory forensics if process evades disk-based detect",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Conduct memory forensics if process evades disk-based detection (fileless malware)"
    },
    {
      "name": "Search the same C2 across all customer environments",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CC-001 — C2 Beaconing Pattern",
        "description": "Flags periodic outbound connections from a host to the same external destination with low timing jitter, the statistical signature of C2 beaconing. (Source: Bell Integration baseline detection library, mapped via sub-technique T1071.001.)",
        "query": "let Exclusions = dynamic([\n    \"microsoft.com\", \"windowsupdate.com\", \"office.com\", \"live.com\",\n    \"azure.com\", \"office365.com\", \"microsoftonline.com\",\n    \"google.com\", \"gstatic.com\", \"googleapis.com\",\n    \"akamai.com\", \"cloudflare.com\", \"fastly.net\", \"amazonaws.com\",\n    \"apple.com\", \"icloud.com\", \"zoom.us\", \"webex.com\", \"teams.microsoft.com\"\n]);\nDeviceNetworkEvents\n| where TimeGenerated >= ago(2h)\n| where ActionType == \"ConnectionSuccess\"\n| where RemotePort in (80, 443, 8080, 8443, 4443)\n| where not(RemoteUrl has_any (Exclusions))\n| where not(RemoteIP has_any (\"10.\", \"192.168.\", \"172.16.\", \"172.17.\", \"172.18.\", \"172.19.\",\n    \"172.20.\", \"172.21.\", \"172.22.\", \"172.23.\", \"172.24.\", \"172.25.\", \"172.26.\", \"172.27.\",\n    \"172.28.\", \"172.29.\", \"172.30.\", \"172.31.\"))\n| sort by DeviceName asc, RemoteIP asc, TimeGenerated asc\n| serialize\n| extend PrevTime = prev(TimeGenerated, 1), PrevDevice = prev(DeviceName, 1), PrevRemoteIP = prev(RemoteIP, 1)\n| where DeviceName == PrevDevice and RemoteIP == PrevRemoteIP\n| extend IntervalSeconds = datetime_diff('second', TimeGenerated, PrevTime)\n| where IntervalSeconds between (30 .. 3600)\n| summarize\n    ConnectionCount = count(),\n    AvgIntervalSec = avg(IntervalSeconds),\n    StdDevSec = stdev(IntervalSeconds),\n    FirstConnection = min(TimeGenerated),\n    LastConnection = max(TimeGenerated)\n    by DeviceName, DeviceId, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName\n| where ConnectionCount >= 8 and StdDevSec <= 30\n| extend BeaconScore = round(100.0 - (StdDevSec / AvgIntervalSec * 100), 1)\n| extend BeaconScore = iff(BeaconScore < 0, 0.0, BeaconScore)\n| extend timestamp = LastConnection, HostCustomEntity = DeviceName, IPCustomEntity = RemoteIP\n| order by BeaconScore desc"
      },
      {
        "name": "GEN-CC-002 — DNS Tunnelling and DGA",
        "description": "Flags DNS tunnelling (abnormally long high-entropy subdomains) and DGA malware (high-volume failed resolutions for random-looking domains). (Source: Bell Integration baseline detection library, mapped via sub-technique T1071.004.)",
        "query": "let TrustedDomains = dynamic([\n    \"microsoft.com\", \"windows.com\", \"office.com\", \"azure.com\", \"google.com\",\n    \"amazonaws.com\", \"akamai.com\", \"cloudflare.com\", \"digicert.com\"\n]);\nlet Tunnelling = (\n    DeviceNetworkEvents\n    | where TimeGenerated >= ago(1h)\n    | where ActionType == \"DnsQueryResponse\"\n    | where not(RemoteUrl has_any (TrustedDomains))\n    | extend DomainLen = strlen(RemoteUrl)\n    | where DomainLen > 50 or RemoteUrl matches regex @\"[a-z0-9]{20,}\\.\"\n    | summarize QueryCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)\n        by DeviceName, InitiatingProcessFileName\n    | where QueryCount > 30\n    | extend DetectionType = \"DNS_Tunnelling\"\n);\nlet DGA = (\n    DeviceNetworkEvents\n    | where TimeGenerated >= ago(1h)\n    | where ActionType == \"ConnectionFailed\"\n    | where not(RemoteUrl has_any (TrustedDomains))\n    | summarize FailCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)\n        by DeviceName, InitiatingProcessFileName\n    | where FailCount > 100 and UniqueDomains > 50\n    | extend DetectionType = \"DGA_Pattern\"\n);\nTunnelling\n| union DGA\n| extend timestamp = now(), HostCustomEntity = DeviceName\n| order by QueryCount desc"
      },
      {
        "name": "baedfdf4-7cc8-45a1-81a9-065821628b83 — RunningRAT request parameters",
        "description": "This detection will alert when RunningRAT URI parameters or paths are detect in an HTTP request. Id the device blocked this communication presence of this alert means the RunningRAT implant is likely still executing on the source host.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1071.001.)",
        "query": "let runningRAT_parameters = dynamic(['/ui/chk', 'mactok=', 'UsRnMe=', 'IlocalP=', 'kMnD=']);\nCommonSecurityLog\n| where RequestMethod == \"GET\"\n| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceAction, DestinationDnsDomain, DestinationIP, RequestURL, SourceIP, SourceHostName, RequestClientApplication\n| where RequestURL has_any (runningRAT_parameters)"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "cf53f532-9cc9-445a-9ae7-fced307ec53c — Cobalt Strike Command and Control Beacon",
        "description": "(ESQL) Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from packetbeat-*, filebeat-*, logs-network_traffic.* metadata _id, _version, _index\n| where (\n    (event.category in (\"network\", \"network_traffic\") and network.protocol in (\"tls\", \"http\")) or\n    data_stream.dataset in (\"network_traffic.tls\", \"network_traffic.http\")\n  )\n| where destination.domain RLIKE \"[a-z]{3}\\\\.stage\\\\.[0-9]{8}\\\\..*\"\n| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, data_stream.dataset, _id, _version, _index"
      },
      {
        "name": "4a4e23cf-78a2-449c-bac3-701924c269d3 — Possible FIN7 DGA Command and Control Behavior",
        "description": "(ESQL) This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from packetbeat-*, filebeat-*, logs-network_traffic.*, logs-panw.panos* metadata _id, _version, _index\n| where (\n    data_stream.dataset in (\"network_traffic.tls\", \"network_traffic.http\") or\n    (event.category in (\"network\", \"network_traffic\") and network.protocol in (\"tls\", \"http\") and network.transport == \"tcp\")\n  )\n| where destination.domain RLIKE \"[a-zA-Z]{4,5}\\\\.(pw|us|club|info|site|top)\"\n| where destination.domain != \"zoom.us\"\n| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, network.transport, data_stream.dataset, _id, _version, _index"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Application Layer Protocol activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "NTP time synchronisation (port 123) — Already filtered by port — NTP is not included",
    "Telemetry agents (Splunk forwarder, Datadog agent) sending heartbeats — Add known agent destination IP/domain to the Exclusions list",
    "Video conferencing heartbeats (Teams, Zoom, Webex) — Pre-excluded in the Exclusions list — add any not covered",
    "Software update checkers — Add known update server domains to Exclusions list"
  ],
  "confluence": {
    "title": "T1071 - Application Layer Protocol Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}