T1001.003Command and Control
Protocol or Service Impersonation
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic. Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
2 Sigma rules tagged T1001.003Protocol or Service ImpersonationT1001.0032 general rules
- Suspicious LDAP-Attributes Usedhightest
- ADSI-Cache File Creation By Uncommon Toolmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Protocol or Service Impersonation
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.