T1071Command and Control
Application Layer Protocol
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
7 Sigma rules tagged T1071Application Layer ProtocolT10717 general rules
- GALLIUM Artefacts - Builtinhightest
- GALLIUM IOCshightest
- HackTool - SILENTTRINITY Stager DLL Loadhightest
- HackTool - SILENTTRINITY Stager Executionhightest
- Github Self-Hosted Runner Executionmediumtest
- Potentially Suspicious Rundll32.EXE Execution of UDL Filemediumtest
- Suspicious Installer Package Child Processmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Application Layer Protocol
1 CVE, by priority. Each link shows its badge.- CVE-2021-45382D-Link Multiple Routers Remote Code Execution VulnerabilityD-Link · Multiple RoutersKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+4 moreMITRE CTID mapping of the KEV entry · follow-on activity97.8%Top 0.09%69.8priority
Linked through a sub-technique
11 more- CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 4 reports99.5%Top 0.06%88.8priority
- CVE-2023-38035Ivanti Sentry Authentication Bypass VulnerabilityIvanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+6 more>99.9%Top 0.03%79.9priority
- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 more>99.9%Top 0.02%79.9priority
- CVE-2023-40044Progress WS_FTP Server Deserialization of Untrusted Data VulnerabilityProgress · WS_FTP ServerKEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1202Indirect Command Execution+1 more90.4%Top 0.2%79.1priority
- CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566PhishingT1059.003Windows Command Shell+6 more81.9%Top 0.35%78.4priority
- CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.8T1497Virtualization/Sandbox EvasionT1622Debugger Evasion+1 more · 3 reports99.8%Top 0.04%77.6priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reports98.6%Top 0.08%74.8priority
- CVE-2021-35394Realtek Jungle SDK Remote Code Execution VulnerabilityRealtek · Jungle Software Development Kit (SDK)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more99.9%Top 0.04%69.9priority
- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 more97.3%Top 0.1%69.0priority
- CVE-2024-4978Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityJustice AV Solutions · Viewer KEVPublic exploitHigh · 8.4T1195.002Compromise Software Supply ChainT1005Data from Local System+2 more26.9%Top 2%68.5priority
- CVE-2009-4324Adobe Acrobat and Reader Use-After-Free VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1071.001Web Protocols81.9%Top 0.35%53.4priority