Techniques › T1071.005 › AN0002
AN0002 Analytic 0002
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects non-standard processes (e.g., PowerShell, python.exe, rundll32.exe) making outbound connections using publish/subscribe protocols (e.g., MQTT, AMQP) over non-browser, encrypted channels, often beaconing to message brokers.</p>
- Detects
- T1071.005 Publish/Subscribe Protocols
- Part of
- DET0002 Behavioral Detection of Publish/Subscribe Protocol Misuse for C2
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| NSM:Flow | mqtt.log / xmpp.log (custom log feeds) | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UnusualProcessList | Detect suspicious processes initiating outbound pub/sub connections |
TimeWindow | Define beaconing interval used for temporal correlation |
ProtocolPortList | Custom MQTT/XMPP port use in non-standard ranges (e.g., 1883, 5222, 5672) |