Non-Application Layer Protocol

Anchor has used ICMP in C2 communications.^[4]

APT29 uses TCP for C2 communications.^[5]

An APT3 downloader establishes SOCKS5 connections for its initial C2.^[6]

Aria-body has used TCP in C2 communications.^[7]

BUBBLEWRAP can communicate using SOCKS.^[8]

Carbon uses TCP and UDP for C2.^[9]

Crimson uses a custom TCP protocol for C2.^[10]

Cryptoistic can use TCP in communications with C2.^[11]

Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.^[12]

Drovorub can use TCP to communicate between its agent and client modules.^[13]

Some variants of FakeM use SSL to communicate with C2 servers.^[14]

FIN6 has used Metasploit Bind and Reverse TCP stagers.^[15]

gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.^[16]

HiddenWasp communicates with a simple network protocol over TCP.^[17]

InvisiMole has used TCP to download additional modules.^[18]

Metamorfo has used raw TCP for C2.^[19]

Mis-Type network traffic can communicate over a raw socket.^[20]

Misdat network traffic communicates over a raw socket.^[20]

MoonWind completes network communication via raw sockets.^[21]

If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.^[22]

PHOREAL communicates via ICMP for C2.^[23]

The PipeMon communication module can use a custom protocol based on TLS over TCP.^[24]

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.^[25]

PlugX can be configured to use raw TCP or UDP for command and control.^[26]

RARSTONE uses SSL to encrypt its communication with its C2 server.^[27]

Some Reaver variants use raw TCP for C2.^[28]

The Regin malware platform can use ICMP to communicate between infected computers.^[29]

Remsec is capable of using ICMP, TCP, and UDP for C2.^[30][31]

SDBot has the ability to communicate with C2 with TCP over port 443.^[32]

TSCookie can use ICMP to receive information on the destination server.^[33]

Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.^[34]

WellMail can use TCP for C2 communications.^[35]

WINDSHIELD C2 traffic can communicate via TCP raw sockets.^[23]

Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.^[36]

Filter network traffic to prevent use of protocols across the network boundary that are unnecessary.

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems. Also ensure hosts are only provisioned to communicate over authorized interfaces.