value:  APT18 uses HTTP for C2 communications. ;; APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2. ;; Later implants used by APT28 such as CHOPSTICK use a blend of HTTP and other legitimate channels for C2 depending on module configuration. ;; APT29 has used HTTP for C2 and data exfiltration. ;; APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP. ;; APT33 has used HTTP for command and control. ;; APT37 uses HTTPS to conceal C2 communications. ;; APT38 used a backdoor QUICKRIDE to communicate to the C2 server over HTTP and HTTPS. ;; APT39 has used HTTP in communications with C2. ;; APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits. ;; Aria-body has used HTTP in C2 communications. ;; Avenger has the ability to use HTTP in communication with C2. ;; BackConfig has the ability to use HTTPS for C2 communiations. ;; BACKSPACE uses HTTP as a transport to communicate with its command server. ;; BADNEWS establishes a backdoor over HTTP. ;; BadPatch uses HTTP for C2. ;; Bankshot uses HTTP for command and control communication. ;; Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications. ;; BBK has the ability to use HTTP in communications with C2. ;; BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server. ;; Bisonal uses HTTP for C2 communications. ;; BlackEnergy communicates with its C2 server over HTTP. ;; BlackMould can send commands to C2 in the body of HTTP POST requests. ;; BLINDINGCAN has used HTTPS over port 443 for command and control. ;; BRONZE BUTLER malware has used HTTP for C2. ;; BUBBLEWRAP can communicate using HTTP or HTTPS. ;; Bundlore uses HTTP requests for C2. ;; The Carbanak malware communicates to its command server using HTTP with an encrypted payload. ;; Carberp has connected to C2 servers via HTTP. ;; Carbon can use HTTP in C2 communications. ;; Cardinal RAT is downloaded using HTTP over port 443. ;; ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header. ;; Chimera has used HTTPS for C2 communications. ;; China Chopper's server component executes code sent via HTTP POST commands. ;; Various implementations of CHOPSTICK communicate with C2 over HTTP. ;; One variant of CloudDuke uses HTTP and HTTPS for C2. ;; Cobalt Group has used HTTPS for C2. ;; Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports. ;; Comnie uses HTTP for C2 communication. ;; ComRAT has used HTTP requests for command and control. ;; CORESHELL can communicate over HTTP for C2. ;; CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers. ;; CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS. ;; Crutch has conducted C2 communications with a Dropbox account using the HTTP API. ;; CSPY Downloader can use GET requests to download additional payloads from C2. ;; Dacls can use HTTPS in C2 communications. ;; Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”. ;; DarkComet can use HTTP for C2 communications. ;; Daserf uses HTTP for C2. ;; DealersChoice uses HTTP for communication with the C2 server. ;; Dipsind uses HTTP for C2. ;; Doki has communicated with C2 over HTTPS. ;; down_new has the ability to use HTTP in C2 communications. ;; DownPaper communicates to its C2 server over HTTP. ;; Dridex has used HTTPS for C2 communications. ;; Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request. ;; DustySky has used both HTTP and HTTPS for C2. ;; Dyre uses HTTPS for C2 communications. ;; Egregor has communicated with its C2 servers via HTTPS protocol. ;; Elise communicates over HTTP or HTTPS for C2. ;; ELMER uses HTTP for command and control. ;; Emissary uses HTTP or HTTPS for C2. ;; Empire can conduct command and control over protocols like HTTP and HTTPS. ;; Epic uses HTTP and HTTPS for C2 communications. ;; EvilBunny has executed C2 commands directly via HTTP. ;; Exaramel for Linux uses HTTPS for C2 communications. ;; Explosive has used HTTP for communication. ;; FatDuke can be controlled via a custom C2 protocol over HTTP. ;; Felismus uses HTTP for C2. ;; FELIXROOT uses HTTP and HTTPS to communicate with the C2 server. ;; FIN4 has used HTTP POST requests to transmit data. ;; Final1stspy uses HTTP for C2. ;; FlawedAmmyy has used HTTP for C2. ;; A Gamaredon Group file stealer can communicate over HTTP for C2. ;; Gazer communicates with its C2 servers over HTTP. ;; GeminiDuke uses HTTP and HTTPS for command and control. ;; Get2 has the ability to use HTTP to send information collected from an infected host to C2. ;; Gold Dragon uses HTTP for communication to the control servers. ;; GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication. ;; GoldFinder has used HTTP for C2. ;; GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2. ;; Goopy has the ability to communicate with its C2 over HTTP. ;; Grandoreiro has the ability to use HTTP in C2 communications. ;; GravityRAT uses HTTP for C2. ;; GreyEnergy uses HTTP and HTTPS for C2 communications. ;; GuLoader can use HTTP to retrieve additional binaries. ;; HAFNIUM has used open-source C2 frameworks including Covenant. ;; The Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands. ;; HAWKBALL has used HTTP to communicate with a single hard-coded C2 server. ;; Helminth can use HTTP for C2. ;; Hi-Zor communicates with its C2 server over HTTPS. ;; Higaisa used HTTP and HTTPS to send data back to its C2 server. ;; Hikit has used HTTP for C2. ;; HTTPBrowser has used HTTP and HTTPS for command and control. ;; httpclient uses HTTP for command and control. ;; HyperBro has used HTTPS for C2 communications. ;; IcedID has used HTTPS in communications with C2. ;; Inception has used HTTP HTTPS and WebDav in network communications. ;; InvisiMole uses HTTP for C2 communications. ;; Ixeshe uses HTTP for command and control. ;; JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS. ;; Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API. ;; Ke3chang malware RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2. ;; Keydnap uses HTTPS for command and control. ;; KGH_SPY can send data to C2 with HTTP POST requests. ;; Kinsing has communicated with C2 over HTTP. ;; The Komplex C2 channel uses HTTP POST requests. ;; KONNI has used HTTP for C2. ;; Lazarus Group malware has conducted C2 over HTTP and HTTPS. ;; Lokibot has used HTTP for C2 communications. ;; LookBack’s C2 proxy tool sends data to a C2 server over HTTP. ;; LOWBALL command and control occurs via HTTPS over port 443. ;; Machete uses HTTP for Command & Control. ;; MacSpy uses HTTP for command and control. ;; Magic Hound malware has used HTTP for C2. ;; Maze has communicated to hard-coded IP addresses via HTTP. ;; MCMD can use HTTPS in communication with C2 web servers. ;; MechaFlounder has the ability to use HTTP in communication with C2. ;; Metamorfo has used HTTP for downloading items. ;; Micropsia uses HTTP and HTTPS for C2 network communications. ;; MiniDuke uses HTTP and HTTPS for command and control. ;; Mis-Type network traffic can communicate over HTTP. ;; More_eggs uses HTTPS for C2. ;; MuddyWater has used HTTP for C2 communications. ;; Mustang Panda has communicated with its C2 via HTTP POST requests. ;; NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2. ;; NETWIRE has the ability to communicate over HTTP. ;; Night Dragon has used HTTP for C2. ;; njRAT has used HTTP for C2 communications. ;; NOKKI has used HTTP for C2 communications. ;; Octopus uses HTTP for C2 communications. ;; OilRig has used HTTP for C2. ;; Okrum uses HTTP for communication with its C2. ;; OLDBAIT can use HTTP for C2. ;; OnionDuke uses HTTP and HTTPS for C2. ;; OopsIE uses HTTP for C2 communications. ;; Orangeworm has used HTTP for C2. ;; OSX_OCEANLOTUS.D can use HTTP POST and GET requests to send and receive C2 information. ;; Out1 can use HTTP and HTTPS in communications with remote hosts. ;; OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions. ;; P.A.S. Webshell can issue commands via HTTP POST. ;; PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server. ;; PLEAD has used HTTP for communications with command and control (C2) servers. ;; PlugX can be configured to use HTTP for command and control. ;; pngdowner uses HTTP for command and control. ;; PoetRAT has used HTTP and HTTPs for C2 communications. ;; PolyglotDuke has has used HTTP GET requests in C2 communications. ;; Pony has sent collected information to the C2 via HTTP POST request. ;; PoshC2 can use protocols like HTTP/HTTPS for command and control traffic. ;; PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions. ;; POWERTON has used HTTP/HTTPS for C2 traffic. ;; POWRUNER can use HTTP for C2 communications. ;; Proxysvc uses HTTP over SSL to communicate commands with the control server. ;; Psylo uses HTTPS for C2. ;; Pteranodon can use HTTP for C2. ;; PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests. ;; Pupy can communicate over HTTP for C2. ;; QUADAGENT uses HTTPS and HTTP for C2 communications. ;; Ramsay has used HTTP for C2. ;; Rancor has used HTTP for C2. ;; RATANKBA uses HTTP/HTTPS for command and control communication. ;; RDAT can use HTTP communications for C2 as well as using the WinHTTP library to make requests to the Exchange Web Services API. ;; Some Reaver variants use HTTP for C2. ;; RedLeaves can communicate to its C2 over HTTP and HTTPS if directed. ;; The Regin malware platform supports many standard protocols including HTTP and HTTPS. ;; Remexi uses BITSAdmin to communicate with the C2 server over HTTP. ;; Remsec is capable of using HTTP and HTTPS for C2. ;; REvil has used HTTP and HTTPS in communication with C2. ;; RGDoor uses HTTP for C2 communications. ;; APT12 has used RIPTIDE a RAT that uses HTTP to communicate. ;; Rising Sun has used HTTP for command and control. ;; Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol. ;; ROKRAT use HTTPS for all command and control communication methods. ;; RTM has initiated connections to external domains using HTTPS. ;; S-Type uses HTTP for C2. ;; Sakula uses HTTP for C2. ;; Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP. ;; SeaDuke uses HTTP and HTTPS for C2. ;; Seasalt uses HTTP for C2 communications. ;; ServHelper uses HTTP for C2. ;; ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL. ;; Shamoon has used HTTP for C2. ;; ShimRat communicated over HTTP and HTTPS with C2 servers. ;; ShimRatReporter communicated over HTTP with preconfigured C2 servers. ;; Sibot communicated with its C2 server via HTTP GET requests. ;; Sidewinder has used HTTP in C2 communications. ;; SilverTerrier uses HTTP for C2 communications. ;; SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications. ;; Smoke Loader uses HTTP for C2. ;; SNUGRIDE communicates with its C2 server over HTTP. ;; SoreFang can use HTTP in C2 communications. ;; Spark has used HTTP POST requests to communicate with its C2 server to receive commands. ;; SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server. ;; Stealth Falcon malware communicates with its C2 server via HTTPS. ;; StrongPity can use HTTP and HTTPS in C2 communications. ;; SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2. ;; SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute. ;; Sys10 uses HTTP for C2. ;; TA505 has used HTTP to communiate with C2 nodes. ;; TA551 has used HTTP for C2 communications. ;; ThiefQuest uploads files via unencrypted HTTP. ;; Threat Group-3390 malware has used HTTP for C2. ;; TrickBot uses HTTPS to communicate with its C2 servers to get malware updates modules that perform most of the malware logic and various configuration files. ;; Trojan.Karagany can communicate with C2 via HTTP POST requests. ;; Tropic Trooper has used HTTP in communication with the C2. ;; TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers. ;; Turla has used HTTP and HTTPS for C2 communications. ;; UBoatRAT has used HTTP for C2 communications. ;; UNC2452 used HTTP for C2 and data exfiltration. ;; UPPERCUT has used HTTP for C2 including sending error codes in Cookie headers. ;; Ursnif has used HTTPS for C2. ;; Valak has used HTTP in communications with C2. ;; Vasport creates a backdoor by making a connection using a HTTP POST. ;; VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP. ;; VERMIN uses HTTP for C2 communications. ;; WellMess can use HTTP and HTTPS in C2 communications. ;; Windshift has used tools that communicate with C2 over HTTP. ;; WindTail has the ability to use HTTP for C2 communications. ;; WinMM uses HTTP for C2. ;; Winnti for Linux has used HTTP in outbound communications. ;; WIRTE has used HTTP for network communication. ;; Wizard Spider has used HTTP for network communications. ;; Xbash uses HTTP for C2 communications. ;; YAHOYAH uses HTTP for C2. ;; Zebrocy uses HTTP for C2. ;; ZeroT has used HTTP for C2. ;; Zeus Panda uses HTTP for C2 communications. ;; ZLib communicates over HTTP for C2. ;; ZxShell has used HTTP for C2 connections. "
name: Application Layer Protocol: Web Protocols