Cross-source coverage
T1095 / ATT&CK
Non-Application Layer Protocol
65 rules across 8 sources.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
ICMP communication between hosts is one example. Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts. However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.
In ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host’s backdoor, regardless of network segmentation or firewall rules in place.
- Tactics
- Command and Control
- Platforms
- ESXi · Linux · macOS · Network Devices · Windows
- Telemetry
-
WinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:unifiedlogesxi:vmkernelNSM:Firewall
How MITRE says to detect it DET0457
Detection of Non-Application Layer Protocols for C2
Windows Analytic 1254
Anomalous use of ICMP or UDP by non-network service processes for data exfiltration or remote control, especially if traffic bypasses proxy infrastructure or shows unusual flow patterns.
WinEventLog:SysmonEventCode=3, 22NSM:FlowICMP/UDP traffic (Wireshark, Suricata, Zeek)
Linux Analytic 1255
ICMP or raw socket traffic generated by user-mode processes like bash, Python, or nc, typically using `ping`, `hping3`, or crafted packets via libpcap or scapy.
auditd:SYSCALLsendto/connectNSM:Flowicmp.log, weird.log
macOS Analytic 1256
Unsigned binaries or interpreted scripts initiating non-standard protocols (ICMP, UDP, SOCKS) outside of baseline network behavior.
macos:unifiedlogcom.apple.networkNSM:FlowICMP/UDP monitoring (tcpdump, Wireshark, Zeek)
ESXi Analytic 1257
VMCI (Virtual Machine Communication Interface) traffic between guest and host, or between VMs, originating from non-management tools or unauthorized binaries.
esxi:vmkernelVMCI syslog entries
Network Devices Analytic 1258
Non-standard port/protocol pairings or low-entropy ICMP traffic resembling tunneling patterns (e.g., fixed-size pings with delays).
NSM:FirewallICMP/UDP protocol anomalyNSM:Flowconn.log, icmp.log
elastic/detection-rules
20 rules| Detection | Severity | Format |
|---|---|---|
| GKE Pod Exec Potential Reverse Shell | High | Elastic TOML |
| Potential Command Shell via NetCat | High | Elastic TOML |
| Potential Reverse Shell | High | Elastic TOML |
| Potential Reverse Shell Activity via Terminal | High | Elastic TOML |
| Potential Reverse Shell via Background Process | High | Elastic TOML |
| Potential Reverse Shell via Child | High | Elastic TOML |
| Potential Reverse Shell via Suspicious Binary | High | Elastic TOML |
| Potential Reverse Shell via Suspicious Child Process | High | Elastic TOML |
| Suspicious React Server Child Process | High | Elastic TOML |
| Web Server Exploitation Detected via Defend for Containers | High | Elastic TOML |
+ 10 more from elastic/detection-rules → showing the 10 highest-severity
Wazuh Core Ruleset
17 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious binary created network connection to · win.eventdata.image = (*UTF)\N{U+202E} | Critical | Wazuh XML |
| An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started | Medium | Wazuh XML |
| Arpwatch: Possible arpspoofing attempt. | Medium | Wazuh XML |
| ASA: ARP collision detected. | Medium | Wazuh XML |
| During Extended Mode negotiation, IPsec received an invalid negotiation packet | Medium | Wazuh XML |
| During Main Mode negotiation, IPsec received an invalid negotiation packet | Medium | Wazuh XML |
| During Quick Mode negotiation, IPsec received an invalid negotiation packet | Medium | Wazuh XML |
| FTD: ARP collision detected. | Medium | Wazuh XML |
| PIX: ARP collision detected. | Medium | Wazuh XML |
| Reject: Prohibit a packet from passing. Send an ICMP destination-unreachable back to the source host. | Medium | Wazuh XML |
+ 7 more from Wazuh Core Ruleset → showing the 10 highest-severity
Emerging Threats Open
12 rules| Detection | Severity | Format |
|---|---|---|
| ET MALWARE SillyRAT CnC Command Inbound (Keylogger:Dump) | Critical | Suricata |
| ET MALWARE SillyRAT CnC Command Inbound (Keylogger:On) | Critical | Suricata |
| ET MALWARE SillyRAT CnC Command Inbound (Screenshot) | Critical | Suricata |
| ET MALWARE SillyRAT CnC Command Inbound (shell) | Critical | Suricata |
| ET MALWARE SillyRAT CnC Command Inbound (sysinfo) | Critical | Suricata |
| ET MALWARE SillyRAT CnC Server PING Inbound | Critical | Suricata |
| ET MALWARE SillyRAT CnC Victim Keylogger Exfil | Critical | Suricata |
| ET MALWARE VenomRAT CnC Server Keepalive | Critical | Suricata |
| ET MALWARE ZeroTrace CnC Server Settings Inbound | Critical | Suricata |
| ET MALWARE GorillaBot CnC Magic-Byte Response (Bot Configuration) | High | Suricata |
+ 2 more from Emerging Threats Open → showing the 10 highest-severity
socfortress/Wazuh-Rules
8 rules| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · At.exe Scheduled Task (T1053.002) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Netcat Execution (T1095) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell C2 Scripts (T1095) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Download Nishang (T1095) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Download Powercat (T1095) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell references RAT file (T1219) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Scheduled Task via schtasks.exe (T1053.005) | High | Wazuh XML |
| ICMP-based reverse shell client execution detected (MITRE T1095 - Non-Application Layer Protocol) | Medium | Wazuh XML |
SigmaHQ/sigma
3 rules| Detection | Severity | Format |
|---|---|---|
| PUA - Netcat Suspicious Execution | High | Sigma |
| Netcat The Powershell Version | Medium | Sigma |
| Suspicious DNS Z Flag Bit Set | Medium | Sigma |
chainguard-dev/osquery-defense-kit
2 rules| Detection | Severity | Format |
|---|---|---|
| Unexpected programs speaking over ICMP (event-based) | Undefined | osquery SQL |
| Unexpected programs speaking over ICMP (state-based) | Undefined | osquery SQL |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| Detect Large ICMP Traffic | Undefined | SPL |
| Linux Proxy Socks Curl | Undefined | SPL |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| RedMenshen-BPFDoor-backdoor | Undefined | KQL |