Non-Application Layer Protocol

Non-Application Layer Protocol [T1095]

Information

• Name: Non-Application Layer Protocol

• ID: T1095

• Tactics: TA0011

Introduction

Non-Application Layer Protocol is a technique categorized under MITRE ATT&CK framework (Technique ID: T1095). Adversaries leverage network protocols that operate below the application layer (OSI layers 3 and 4, such as ICMP, TCP, UDP) to communicate, control compromised systems, exfiltrate data, and evade detection. By utilizing these lower-level protocols, attackers can bypass traditional security defenses that primarily monitor application-layer traffic (e.g., HTTP, DNS).

Deep Dive Into Technique

Attackers utilize Non-Application Layer Protocols to establish covert communication channels, evade network monitoring, and maintain persistent access. Technical execution methods typically involve:

• ICMP Tunneling:

  • Embedding payloads within ICMP echo request/reply packets.

  • Tools such as ICMP Shell, PingTunnel, or Loki can facilitate command and control (C2) communication or data exfiltration.

• UDP and TCP Covert Channels:

  • Manipulating packet headers and payloads to hide data within legitimate protocol traffic.

  • Techniques include embedding data in TCP sequence numbers, acknowledgment fields, or UDP payloads.

  • Tools like DNScat2 (over UDP), ptunnel, or iodine are commonly employed.

• Protocol Misuse and Fragmentation:

  • Fragmenting packets to evade IDS/IPS detection.

  • Abnormal use of flags, packet sizes, or header fields to embed malicious payloads or instructions.

• Custom Protocols and Raw Sockets:

  • Crafting custom protocols or utilizing raw sockets to directly manipulate packet headers.

  • This approach allows attackers to evade signature-based detections and standard protocol inspection.

When this Technique is Usually Used

Attackers may employ Non-Application Layer Protocol techniques across various stages of the attack lifecycle, including:

• Initial Access and Reconnaissance:

  • Using ICMP or UDP packets to probe network boundaries, firewall rules, and system responsiveness.

• Command and Control (C2):

  • Establishing covert communication channels to remotely control compromised hosts without detection by standard application-layer monitoring.

• Data Exfiltration:

  • Transferring sensitive data out of the victim network through covert channels embedded in lower-level protocols, bypassing traditional data loss prevention (DLP) systems.

• Persistence and Evasion:

  • Maintaining long-term covert communication channels to evade detection by security monitoring solutions focused primarily on application-layer traffic.

How this Technique is Usually Detected

Detection of Non-Application Layer Protocol exploitation can be challenging, but several methods and tools can assist:

• Network Traffic Analysis:

  • Monitoring for unusual patterns or anomalies in ICMP, TCP, or UDP traffic.

  • Tools such as Wireshark, Zeek (formerly Bro), Suricata, and Snort can detect abnormal protocol usage or unusual packet structures.

• Behavioral Anomaly Detection:

  • Implementing machine learning-based or heuristic analysis systems (e.g., Darktrace, Cisco Stealthwatch) to identify deviations from typical network behaviors.

  • Detecting unusual ICMP payload sizes, high volumes of ICMP traffic, or irregular TCP/UDP packet fragmentation.

• Endpoint Detection and Response (EDR):

  • Monitoring system-level socket operations, raw socket usage, and unusual network connections.

  • Tools such as CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint can detect suspicious process behavior or network activity.

• Specific Indicators of Compromise (IoCs):

  • High frequency of ICMP echo requests/replies from a single host.

  • Unusual fragmentation patterns or abnormal TCP/UDP packet sizes.

  • Connections to known malicious IP addresses or domains associated with covert channel tools.

Why it is Important to Detect This Technique

Detecting Non-Application Layer Protocol misuse is critical due to several high-impact risks:

• Stealthy Data Exfiltration:

  • Attackers can silently remove large volumes of sensitive data, intellectual property, or confidential information without triggering traditional alerts.

• Persistent Command and Control:

  • Covert communication channels can remain active for extended periods, allowing attackers continuous control and access to compromised systems.

• Security Monitoring Evasion:

  • Traditional security solutions concentrating on application-layer traffic may fail to detect lower-layer protocol misuse, leaving organizations blind to ongoing malicious activities.

• Operational Disruption and Damage:

  • Undetected covert channels can facilitate lateral movement, privilege escalation, and deployment of additional malicious payloads, significantly increasing the potential impact of an attack.

Early detection and mitigation of Non-Application Layer Protocol abuse help prevent attackers from achieving their objectives, limiting potential damage and maintaining organizational security posture.

Examples

Real-world examples highlighting the usage and impact of Non-Application Layer Protocol attacks include:

• Operation TunnelSnake (ICMP Tunneling):

  • Attackers used ICMP tunneling to establish persistent covert channels, evade detection, and exfiltrate sensitive data from compromised networks.

  • Tools involved included PingTunnel and ICMP Shell, allowing attackers to bypass firewall rules blocking traditional application-layer protocols.

• Loki ICMP Tunneling:

  • Loki is a publicly available tool that embeds payloads within ICMP packets to establish covert C2 channels.

  • Attackers leveraged Loki in targeted attacks to maintain persistent and stealthy communication with compromised hosts, bypassing standard IDS/IPS systems.

• DNScat2 (UDP Protocol Abuse):

  • DNScat2 utilizes DNS queries (UDP protocol) to establish covert communication channels and exfiltrate data.

  • Attackers employed DNScat2 in multiple documented breaches, successfully evading monitoring solutions focused on HTTP and HTTPS traffic.

• Advanced Persistent Threat (APT) Groups:

  • APT29 (Cozy Bear) and APT28 (Fancy Bear) have historically leveraged lower-layer protocol tunneling and covert channels to evade detection, perform reconnaissance, and exfiltrate sensitive data from targeted networks.

  • These sophisticated adversaries frequently employ customized implementations of ICMP and UDP tunneling to remain undetected and maintain long-term access.

These examples underscore the critical importance of monitoring and detecting Non-Application Layer Protocol abuse to prevent severe security implications and mitigate potential damage from sophisticated cyber-attacks.