Esc
Protocol Impersonation - T1001.003
(ATT&CK® Technique)
Definition
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
D3FEND Inferred Relationships
Browse the D3FEND knowledge graph by clicking on the nodes below.
graph LR; T1001003["Protocol Impersonation"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1001003 OffensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic"; click T1001003 href "/offensive-technique/attack/T1001.003/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";Client-serverPayloadProfiling["Client-server Payload Profiling"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; Client-serverPayloadProfiling["Client-server Payload Profiling"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class Client-serverPayloadProfiling DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; RelayPatternAnalysis["Relay Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RelayPatternAnalysis["Relay Pattern Analysis"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class RelayPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis"; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] --> | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.-> | May Detect | T1001003["Protocol Impersonation"] ; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; NetworkTrafficFiltering["Network Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; NetworkTrafficFiltering["Network Traffic Filtering"] -.-> | May Isolate | T1001003["Protocol Impersonation"] ; class NetworkTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; OutboundTrafficFiltering["Outbound Traffic Filtering"] --> | filters | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; OutboundTrafficFiltering["Outbound Traffic Filtering"] -.-> | May Isolate | T1001003["Protocol Impersonation"] ; class OutboundTrafficFiltering DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering";