H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Custom Command and Control Protocol

Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.

1 recorded

Relationships

revoked-by
to Non-Application Layer Protocol
Technique
2 external

References

mitre-attack
T1094
open
University of Birmingham C2
https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance