T1095 — Non-Application Layer Protocol

# T1095 - Non-Application Layer Protocol

## SOC Recommendation
Investigate Non-Application Layer Protocol activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let lb_period = 14d;
let q_time = 1h;
let inet_access_proc = CyberArkEPM
| where TimeGenerated between (ago(lb_period) .. ago(q_time))
| where EventSubType =~ 'DetectAccessInternet'
| where isnotempty(ActingProcessFileInternalName)
| summarize makeset(ActingProcessFileInternalName);
CyberArkEPM
| where TimeGenerated > ago(q_time)
| where EventSubType =~ 'DetectAccessInternet'
| where ActingProcessFileInternalName !in (inet_access_proc)
| extend AccountCustomEntity = ActorUsername
```
```kql
GCPCloudDNS
| where Query has_any ('tomasubiera.com', 'theandersonco.com', 'stonecrestnews.com', 'nordicmademedia.com')
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
```
```kql
let ip_check = dynamic(['whatismyipaddress.com', 'ip2location.com', 'ipaddress.my', 'whatismyip.com', 'ipinfo.info', 'checkmyip.com', 'myip.com', 'checkmyip.org', 'canireachthe.net', 'ipv4.icanhazip.com', 'ip.anysrc.net', 'edns.ip-api.com', 'wtfismyip.com', 'checkip.dyndns.org', 'api.2ip.ua', 'icanhazip.com', 'api.ipify.org', 'ip-api.com', 'checkip.amazonaws.com', 'ipecho.net', 'ipinfo.io', 'ipv4bot.whatismyipaddress.com', 'freegeoip.app', 'checkip.azurewebsites.net']);
GCPCloudDNS
| where Query in~ (ip_check)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
```

## Escalation Criteria
- Non-Application Layer Protocol activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1095.json
• /api/recommendations/T1095.json
• /api/d3fend/T1095.json
• /api/mappings/T1095.json
• /api/confluence/T1095.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1095.json

Response:

{
  "technique_id": "T1095",
  "name": "Non-Application Layer Protocol",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Command and Control"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Network Devices",
    "Windows"
  ],
  "summary": "Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL)...",
  "soc_recommendation": "Investigate Non-Application Layer Protocol activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-UGLPA",
      "name": "User Geolocation Logon Pattern Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-NTF",
      "name": "Network Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed non-application layer protocol activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"CyberArkEPM - Uncommon process Internet access\" -- Detects access to the Internet by uncommon processes.'"
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "9d0d44ab-54dc-472a-9931-53521e888932 — CyberArkEPM - Uncommon process Internet access",
        "description": "Detects access to the Internet by uncommon processes.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let lb_period = 14d;\nlet q_time = 1h;\nlet inet_access_proc = CyberArkEPM\n| where TimeGenerated between (ago(lb_period) .. ago(q_time))\n| where EventSubType =~ 'DetectAccessInternet'\n| where isnotempty(ActingProcessFileInternalName)\n| summarize makeset(ActingProcessFileInternalName);\nCyberArkEPM\n| where TimeGenerated > ago(q_time)\n| where EventSubType =~ 'DetectAccessInternet'\n| where ActingProcessFileInternalName !in (inet_access_proc)\n| extend AccountCustomEntity = ActorUsername"
      },
      {
        "name": "22a613ea-c338-4f91-bbd3-3be97b00ebf9 — Google DNS - UNC2452 (Nobelium) APT Group activity",
        "description": "Detects UNC2452 (Nobelium) APT Group activity.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "GCPCloudDNS\n| where Query has_any ('tomasubiera.com', 'theandersonco.com', 'stonecrestnews.com', 'nordicmademedia.com')\n| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr"
      },
      {
        "name": "35221a58-cacb-4174-9bb4-ee777784fbce — Google DNS - IP check activity",
        "description": "Detects requests to ip lookup resources.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let ip_check = dynamic(['whatismyipaddress.com', 'ip2location.com', 'ipaddress.my', 'whatismyip.com', 'ipinfo.info', 'checkmyip.com', 'myip.com', 'checkmyip.org', 'canireachthe.net', 'ipv4.icanhazip.com', 'ip.anysrc.net', 'edns.ip-api.com', 'wtfismyip.com', 'checkip.dyndns.org', 'api.2ip.ua', 'icanhazip.com', 'api.ipify.org', 'ip-api.com', 'checkip.amazonaws.com', 'ipecho.net', 'ipinfo.io', 'ipv4bot.whatismyipaddress.com', 'freegeoip.app', 'checkip.azurewebsites.net']);\nGCPCloudDNS\n| where Query in~ (ip_check)\n| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "a1a0375f-22c2-48c0-81a4-7c2d11cc6856 — Potential Reverse Shell Activity via Terminal",
        "description": "(EQL) Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where event.type in (\"start\", \"process_started\") and\n  process.name in (\"sh\", \"bash\", \"zsh\", \"dash\", \"zmodload\") and\n  process.args : (\"*/dev/tcp/*\", \"*/dev/udp/*\", \"*zsh/net/tcp*\", \"*zsh/net/udp*\") and\n\n  /* noisy FPs */\n  not (process.parent.name : \"timeout\" and process.executable : \"/var/lib/docker/overlay*\") and\n  not process.command_line : (\n    \"*/dev/tcp/sirh_db/*\", \"*/dev/tcp/remoteiot.com/*\", \"*dev/tcp/elk.stag.one/*\", \"*dev/tcp/kafka/*\",\n    \"*/dev/tcp/$0/$1*\", \"*/dev/tcp/127.*\", \"*/dev/udp/127.*\", \"*/dev/tcp/localhost/*\", \"*/dev/tcp/itom-vault/*\") and\n  not process.parent.command_line : \"runc init\""
      },
      {
        "name": "ae3e9625-89ad-4fc3-a7bf-fced5e64f01b — Suspicious React Server Child Process",
        "description": "(EQL) This rule detects suspicious child process activity from a React server application. This could be related to successful exploitation of CVE-2025-55182 or CVE-2025-66478... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where event.type == \"start\" and event.action in (\"exec\", \"executed\", \"start\", \"process_started\") and (\n    process.name in (\n      \"sh\", \"bash\", \"zsh\", \"dash\", \"curl\", \"wget\", \"id\", \"whoami\", \"uname\", \"cmd.exe\", \"cat\", \"powershell.exe\", \"java\", \"rundll32.exe\", \"wget.exe\", \"certutil.exe\",\n      \"nc\", \"ncat\", \"netcat\", \"nc.openbsd\", \"nc.traditional\", \"socat\", \"busybox\", \"mkfifo\", \"nohup\", \"setsid\", \"xterm\"\n    ) or\n    (process.name : \"python*\" and process.args : \"-c\" and process.args : (\n     \"*import*pty*spawn*\", \"*import*subprocess*call*\"\n    )) or\n    (process.name : \"perl*\" and process.args : \"-e\" and process.args : \"*socket*\" and process.args : (\n     \"*exec*\", \"*system*\"\n    )) or\n    (process.name : \"ruby*\" and process.args : (\"-e\", \"-rsocket\") and process.args : (\n     \"*TCPSocket.new*\", \"*TCPSocket.open*\"\n     )) or\n    (process.name : \"lua*\" and process.args : \"-e\" and process.args : \"*socket.tcp*\" and process.args : (\n     \"*io.popen*\", \"*os.execute*\"\n    )) or\n    (process.name : \"php*\" and process.args : \"-r\" and process.args : \"*fsockopen*\" and process.args : \"*/bin/*sh*\") or \n    (process.name == \"node\" and process.args == \"-e\" and process.args : \"*spawn*sh*\" and process.args : \"*connect*\") or\n    (process.name : (\"awk\", \"gawk\", \"mawk\", \"nawk\") and process.args : \"*/inet/tcp/*\") or\n    (process.name in (\"rvim\", \"vim\", \"vimdiff\", \"rview\", \"view\") and process.args == \"-c\" and process.args : \"*socket*\")\n)\nand (\n  ?process.working_directory : (\n    \"*react-dom*\", \"*.next*\", \"*node_modules/next*\", \"*react-server*\", \"*bin/next*\", \"*.pnpm/next*\", \"*next/dist/server*\", \"*react-scripts*\") or\n  (\n    process.parent.name in (\"node\", \"bun\", \"node.exe\", \"bun.exe\") and\n    process.parent.command_line : (\n      \"*react-dom*\", \"*.next*\", \"*node_modules/next*\", \"*react-server*\", \"*next-server*\", \"* server.js*\",  \"*start-server.js*\", \"*bin/next*\",\n      \"*--experimental-https*\", \"*app/server*\", \"*.pnpm/next*\", \"*next start*\", \"*next dev*\", \"*react-scripts start*\", \"*next/dist/server*\"\n    )\n  )\n) and not (\n  ?process.parent.executable in (\"./runc\", \"/opt/google/chrome/chrome\") or\n  process.command_line like \"/bin/sh -c git config*\"\n)"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Non-Application Layer Protocol activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1095 - Non-Application Layer Protocol Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}