Application Layer Protocol
Application-layer command traffic uses protocols already common in the environment.
What it means
Application-layer command traffic uses protocols already common in the environment. Protocol familiarity does not establish that the communicating application or destination is trusted.
An investigation example
A new executable repeatedly sends small HTTPS requests to a destination unrelated to its claimed business purpose.
Evidence to examine
Review process ownership, destination history, request timing, protocol metadata, and associated downloads or collection.
A common analytical pitfall
Traffic on a common port is not automatically normal, and encryption does not make a destination approved.
Response considerations
Correlate network and endpoint evidence, identify the actual application, and contain confirmed unauthorized communication through appropriate controls.
Familiar protocols do not establish a legitimate purpose
Application-layer protocols such as HTTP and DNS carry structured communication understood by services. An intruder can use ordinary protocol features for command and control, potentially blending with routine traffic. The protocol being common or allowed through a firewall does not establish that every conversation using it is authorized.
At the same time, unusual-looking traffic is not automatically hostile. Software telemetry, updates, and distributed applications can generate repetitive or encoded exchanges. Examine the initiating process, destination, message pattern where visible, and expected business purpose. Port numbers and protocol labels are useful clues but do not replace application context.
A fictional periodic web request
An academy notices a workstation process repeatedly contacting a remote endpoint. The traffic uses a normal web protocol, but the process is not a browser or approved agent. Analysts correlate endpoint ancestry, destination history, timing, and any later actions triggered around responses. A periodic interval alone is insufficient to prove a control channel.
Encryption may prevent payload inspection, while endpoint and proxy metadata still provide useful context. State what is visible and avoid claiming exact commands when only connection records exist. If inspection is performed, it needs an appropriate authorized design because it can expose sensitive content and alter operational assumptions.
Compare expected and unexpected clients
Use fictional events for a managed updater and an unfamiliar executable both making web requests. Identify the contextual evidence that would distinguish their purposes. Write a narrow network observation and a separate hypothesis about control activity. Then specify the evidence needed to strengthen that hypothesis.
A good detection approach combines several signals and an environment baseline rather than declaring a protocol malicious. Review the expected client, destination, timing, and subsequent behavior together. This supports proportionate investigation while preserving legitimate communication that uses the same standard.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1071: Application Layer Protocol