Skip to content

Application Layer Protocol

Technique · ATTACK:enterprise:T1071

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1071",
  "title": "Application Layer Protocol",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1071",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--355be19c-ffc9-46d5-8d50-d6a036c675b6",
  "external_id": "T1071",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:56.776Z",
  "modified": "2026-09-03T19:46:45.255Z",
  "version": "2.4",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "Mandiant APT29 Eye Spy Email Nov 22",
      "url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19f35c88-92c4-4e98-b024-be9f6731bdb5

ATTACK:enterprise:T1071.002 → subtechnique-of → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c8ce5e2-3a80-407e-9624-3619528df5fa

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24f1177a-971a-457f-a9b6-36de5fc65d42

Unit 42 Hildegard Malware

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b5af448-59a1-4888-a05f-aee6105872a5

DFIR Phosphorus November 2021 · Unit 42 Magic Hound Feb 2017

ATTACK:enterprise:S0034 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32abb557-d923-4a6d-bda6-79a95063f298

ATTACK:enterprise:C0041 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36223feb-8e44-47e9-9092-d03abf148107

Dragos FROSTYGOOP 2024

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37327da8-efd3-48c0-9f91-38f384f8579e

Talos Rocke August 2018

ATTACK:enterprise:T1071.004 → subtechnique-of → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ebeacbf-4f30-4f32-86dc-54d932ea7c46

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6521c093-6e80-4669-9151-1c4df2dac259

Huntress INC Ransom Group August 2023

ATTACK:enterprise:S0623 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79fd974c-b51b-45d4-b220-6f532ec6bc63

Unit 42 Siloscape Jun 2021

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--864785e4-0495-42a0-8ac6-5f1e71928b65

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S1084 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89544a80-5144-443a-9560-ab8b7a87fa96

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d0d938e-2e4c-49e8-9290-6bfb86161260

Symantec W32.Duqu

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--924d69bd-a87f-4fda-a2cb-73355331aa87

Trend Micro DRBControl February 2020

ATTACK:enterprise:T1071.005 → subtechnique-of → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9364e09e-7c58-4fc3-8761-e21bc043363a

ATTACK:enterprise:T1071.003 → subtechnique-of → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b849b1ae-0b73-484c-9061-38ddf3cbdbb3

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bea6dae9-de47-4b9d-a393-8bf543220ecb

Cybereason Sliver Undated

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfc5ca31-5d92-4c51-be33-e610df85055a

Unit 42 Lucifer June 2020

ATTACK:enterprise:T1071.001 → subtechnique-of → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3d30e12-d4e1-468d-9142-3e925c38658e

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c812f373-23ba-4825-aa0b-6546cf6105e8

Sygnia VelvetAnt 2024A

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0e68e5d-66a1-4f7d-ace6-8ad5d028fa20

Trend Micro TeamTNT

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d863f0be-98bb-42d5-a584-f48fc43022aa

TrendMicro RaspberryRobin 2022 · RedCanary RaspberryRobin 2022 · HP RaspberryRobin 2024

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee0f724e-6622-40db-8a31-82fb6b361e0b

ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd864eec-92f0-4401-8f1e-38130cc6d2e2

ESET EvasivePanda 2024 · Symantec Daggerfly 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.