T1437: Standard Application Layer Protocol
An adversary technique using standard, blend-in network protocols for command-and-control or data exfiltration once a device is compromised.
Why It Matters
This technique explains why insecure communication (M5) matters beyond simple eavesdropping — the same weak network posture that allows interception can also allow a compromised component to blend malicious traffic in with legitimate app traffic.
Application to Application Security
Directly connects to OWASP M5 and ASVS V9 — an app without certificate pinning or strict TLS enforcement makes it easier for both an eavesdropper and a compromised in-app component to communicate over standard-looking traffic.
Relation to Software Development
The same networking-layer hardening (pinning, strict TLS, no cleartext exceptions) that prevents M5 findings also raises the cost of this technique, so the two are effectively addressed by the same engineering work.
How Strata Surfaces This
Strata's M5/ASVS V9 detection (cleartext traffic flags, TLS/cipher analysis, ATS exception parsing) is the app-level control surface relevant to this technique — Strata does not perform network traffic monitoring itself.
Developer guidance
Certificate pinning and strict TLS enforcement raise the cost of this technique the same way they prevent M5 findings — there's no separate control to implement beyond good network-layer hygiene.
Management guidance
Network-layer hardening is one of the few controls that pays off against multiple ATT&CK techniques at once — a good place to prioritize limited security engineering time.