Home/ MITRE Matrix/ Command and Control/ T1095

T1095Non-Application Layer Protocol

T1095 — Non-Application Layer Protocol is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 7 detection use cases covering it and 4 threat-intel articles citing it.

Command and Control

View on the matrix → Filter Detection Library MITRE official spec ↗

7Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (7)

Linux Proxy Socks Curl ESCU actions · alerting P Detect Large ICMP Traffic ESCU actions · alerting P Detect Large Outbound ICMP Packets ESCU actions · alerting P [LLM] TuxBot/Akiru IoT botnet C2 connection to known infrastructure Bespoke c2 · hunting DSΣPCS [LLM] SprySOCKS (FishMonger/I-SOON) C2 beacon to hardcoded Vultr IPs 207.148.78.36 / 207.148.75.122 Bespoke c2 · hunting DSΣPDDCS [LLM] Beaconing to GopherWhisper C2 IP 43.231.113.50 (incl. SSLORDoor raw TLS/443) Bespoke c2 · alerting DSΣPDDCS [LLM] Interactive shell process initiating outbound network connection (reverse-shell C2) Bespoke c2 · hunting DSPCS

Articles citing this technique (4)

crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267

med FishMonger’s arsenal upgraded: SprySOCKS for Windows art-375

crit GopherWhisper: A burrow full of malware art-529

crit Controlling your server with a reverse shell attack art-2099