T1071.001Command and Control
Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S and WebSocket that carry web traffic may be very common in…
CVEs10
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.10
Reports0
Detections
42 Sigma rules tagged T1071.001Web ProtocolsT1071.00142 general rules
- Ursnif Malware C2 URL Patterncriticalstable
- HackTool - BabyShark Agent Default URL Patterncriticaltest
- PwnDrp Accesscriticaltest
- Ursnif Malware Download URL Patternhighstable
- APT User Agenthightest
- APT40 Dropbox Tool User Agenthightest
- Bitsadmin to Uncommon IP Server Addresshightest
- Bitsadmin to Uncommon TLDhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Web Protocols
10 CVEs, by priority. Each link shows its badge.- CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 4 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.5%Top 0.06%88.8priority
- CVE-2023-38035Ivanti Sentry Authentication Bypass VulnerabilityIvanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+6 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.03%79.9priority
- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.9priority
- CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566PhishingT1059.003Windows Command Shell+6 moreMITRE CTID mapping of the KEV entry · follow-on activity81.9%Top 0.35%78.4priority
- CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.8T1497Virtualization/Sandbox EvasionT1622Debugger Evasion+1 more · 3 reportsMITRE CTID mapping of the KEV entry · primary impact99.8%Top 0.04%77.6priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reportsMITRE CTID mapping of the KEV entry · follow-on activity98.6%Top 0.08%74.8priority
- CVE-2021-35394Realtek Jungle SDK Remote Code Execution VulnerabilityRealtek · Jungle Software Development Kit (SDK)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 moreMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.04%69.9priority
- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 moreMITRE CTID mapping of the KEV entry · follow-on activity97.3%Top 0.1%69.0priority
- CVE-2024-4978Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityJustice AV Solutions · Viewer KEVPublic exploitHigh · 8.4T1195.002Compromise Software Supply ChainT1005Data from Local System+2 moreMITRE CTID mapping of the KEV entry · follow-on activity26.9%Top 2%68.5priority
- CVE-2009-4324Adobe Acrobat and Reader Use-After-Free VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1071.001Web ProtocolsMITRE CTID mapping of the KEV entry · primary impact81.9%Top 0.35%53.4priority