Cross-source coverage
T1001.003 / ATT&CK
Data Obfuscation: Protocol or Service Impersonation
2 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.
Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.
- Tactics
- Command and Control
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:unifiedlogmacos:osqueryNSM:Contentesxi:hostd
How MITRE says to detect it DET0470
Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation
Windows Analytic 1294
Untrusted processes creating outbound TLS/HTTPS connections with malformed certificates or header fields, often mismatched with target service behavior. Detects protocol impersonation attempts via traffic metadata analysis and host process lineage.
WinEventLog:SysmonEventCode=3, 22NSM:FlowSSL/TLS Handshake Analysis
Linux Analytic 1295
Detection of binaries spawning encrypted sessions using OpenSSL or curl to external services with mismatched ports/protocols. Identifies behavior where internal services simulate trusted cloud service traffic patterns.
auditd:SYSCALLexecveNSM:FlowNetwork Capture TLS/HTTP
macOS Analytic 1296
Unsigned or suspicious applications initiating network traffic claiming to be browser, mail, or cloud clients. Detects impersonation via TLS fingerprint and User-Agent string deviation.
macos:unifiedlogOutbound Trafficmacos:osqueryProcess Execution + HashNSM:ContentHTTP Header Metadata
ESXi Analytic 1297
ESXi hosts initiating connections from non-standard daemons mimicking HTTP/HTTPS or SNMP traffic, but with irregular payload formats or expired/unsigned TLS certificates.
esxi:hostdService-Based Network ConnectionNSM:ContentTLS Fingerprint and Certificate Analysis
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious LDAP-Attributes Used | High | Sigma |
| ADSI-Cache File Creation By Uncommon Tool | Medium | Sigma |