Publish/Subscribe Protocols (MITRE ATT&CK T1071.005) is a Command and Control technique. MITRE lists macOS, Linux, Windows and network devices as platforms.
Adversaries use publish and subscribe (pub/sub) application-layer protocols to blend in with normal traffic. Commands to the remote system, and often the results, are embedded in the protocol traffic.
How attackers use it
MQTT, XMPP, AMQP and STOMP all use a pub/sub design, with a central broker distributing messages. Publishers sort messages by topic, and subscribers receive messages for the topics they subscribed to. MITRE says an adversary can abuse this to talk to systems under their control from behind a message broker, while looking like expected traffic.
How to detect it
MITRE's detection strategy has four analytics:
- Windows: non-standard processes such as PowerShell, python.exe or rundll32.exe making outbound pub/sub connections, for example MQTT or AMQP, over non-browser encrypted channels and beaconing to brokers.
- Linux: CLI tools such as mosquitto_pub, nc or Python scripts talking to brokers with unusual topic names, high publication rates or obfuscated payloads, to non-standard hosts.
- macOS: osascript, curl or custom binaries talking to XMPP or MQTT brokers at unapproved destinations, with encrypted payloads or frequent POST-like requests.
- Network devices: pub/sub traffic on unusual ports, high-frequency topic publication, and connections to known-bad or dynamic broker endpoints outside your allow list.
Collect flow records, endpoint network telemetry that names the process, and proxy logs. If you run your own brokers, keep broker connection and topic logs too.
How to reduce the risk
MITRE lists two mitigations:
- Filter network traffic. Consider filtering pub/sub requests to untrusted or known bad resources over irregular ports. MITRE gives MQTT's standard ports, 1883 and 8883, as a reference.
- Network intrusion prevention. Use signature-based systems to identify traffic from specific adversary malware.
Quick check
What are MQTT's standard ports according to MITRE?
1883 and 8883.
