← Threat archive

T1071.001 Application Layer Protocol: Web Protocols

3 threats tracked by Spectrum Delta use this technique.

T1071.001 on MITRE ATT&CK →

  • Yoba signed-AI sideload

    Telegram-photo DGA tasking over DoH TXT

    Flow/proxy visibility of HTTPS connections to dns.google, t.me and files.catbox.moe; the inner TXT queries and DGA domains are only visible with TLS inspection or endpoint telemetry

    Seen in: DNS / proxy / flow

  • Armorsteal

    Machine-keyed C2: 60-second polling of signed in-memory Python tasks with versioned channels

    SSL/TLS-inspected outbound HTTPS where the full URL path is visible (Zscaler Web Insights URL field is documented as the entire URL of the transaction, one row per GET, full path+query visible only on inspected transactions — https://help.zscaler.com/zia/web-insights-logs-columns): GET /receive_infof, /get-onetime-code/{id}, /get-global, POST /black-watch/, /infame/receive/; without inspection only the C2 domain (pymons[.]is, datamons[.]org, workerstats[.]net) is visible in DNS/SNI

    Seen in: Zscaler Web Insights (inspected)

  • Lazarus FlashHole

    GitHub private-repository C2 via API

    DNS/flow telemetry: connections to api.github.com, Dropbox API and the named C2 domains from unexpected processes (destination/process correlation); full paths, repository privacy and PAT use require suitable content capture or application instrumentation

    Seen in: Network / proxy / firewall, Sysmon / EDR