Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1071_application-layer-protocol
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Passed 18 of 22 test cases with the skill, and 8 of 22 without it.
and 15 more in the full report
11 fixed7 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
When creating a SIEM detection rule dashboard entry for monitoring application-layer C2, what exact detection strategy title is documented for this technique category?
| Checked | Without skill | With skill |
|---|---|---|
| Titles the strategy Detection of Command and Control Over Application Layer Protocols. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.
Platforms: Linux, macOS, Windows, Network Devices, ESXi
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
An adversary may establish Telnet communication from a compromised endpoint to a command and control (C2) server in order to carry out additional attacks on objectives.
Supported Platforms: windows
#{client_path} #{server_ip} --port #{server_port}
Dependencies:
test cases passed, vs 8 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.