Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

MITRE D3FEND™ Learning Center

D3-CSPP — Client-server Payload Profiling

Comparing client-server request and response payloads to a baseline profile to identify outliers.

72Enterprise inferred
18ICS inferred
1Parent technique
1Related artifact

Detect · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Comparing client-server request and response payloads to a baseline profile to identify outliers.

Official D3FEND knowledge-base content

How it works

Profiling request and response payloads across multiple clients to a single server to develop a baseline of their characteristics. May take into account request/response sizes, entropy, frequency, and rhythm. Finally, identify outliers as they may indicate a malicious payload delivery and subsequent server exploitation.

Considerations

  • Collecting metrics to establish a profile can be challenging since user behavior can change easily.
  • Employees may work different hours or inconsistent schedules which will cause false positives.
  • Collection of network activity to generate metrics is a computationally intensive process.
  • Users may log into different workstations which may cause false positives.
Bare Metal Cyber interpretation

Implementation perspective

Client-server Payload Profiling should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes Network Traffic.

Use the technique to identify suspicious, unauthorized, or abnormal activity through observable evidence and repeatable analysis.

Questions to ask

  • Which events, states, or artifacts must be observed for the analysis to work?
  • What analytic logic, threshold, comparison, or signature turns observations into a finding?
  • How are expected false positives, blind spots, and environmental variations documented?
  • Who receives the result, and what action is expected when the technique produces a finding?

Evidence and validation

  • Telemetry and data-source configuration records
  • Analytic logic, thresholds, signatures, and version history
  • Test cases demonstrating expected positive and negative results
  • Alert, triage, escalation, and tuning records

Common failure patterns

  • Required telemetry is missing, delayed, or transformed in a way that invalidates the analysis.
  • The technique produces alerts without an accountable triage and response process.
  • Detection coverage is claimed from product deployment without testing the relevant analytic behavior.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Direct child techniques

None listed at this level.

D3FEND graph relationships

Artifacts and ontology entities

These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.

Explicit technique relationships

analyzesNetwork Traffic
Show inferred artifact relationship paths (1)
Client-server Payload ProfilinganalyzesNetwork Traffic
Inferred and experimental

Offensive-technique relationships

These relationships are generated from D3FEND graph paths and are explicitly experimental. They should be treated as hypotheses for defensive analysis—not as proof that the technique prevents, detects, or removes an offensive behavior.

ATT&CK Enterprise (72)
T1001Data ObfuscationCommand and ControlT1003.006DCSyncCredential AccessT1008Fallback ChannelsCommand and ControlT1011Exfiltration Over Other Network MediumExfiltrationT1018Remote System DiscoveryDiscoveryT1020Automated ExfiltrationExfiltrationT1021Remote ServicesLateral MovementT1021.001Remote Desktop ProtocolLateral MovementT1021.004SSHLateral MovementT1029Scheduled TransferExfiltrationT1030Data Transfer Size LimitsExfiltrationT1041Exfiltration Over C2 ChannelExfiltrationT1047Windows Management InstrumentationExecutionT1048Exfiltration Over Alternative ProtocolExfiltrationT1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolExfiltrationT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolExfiltrationT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolExfiltrationT1071Application Layer ProtocolCommand and ControlT1071.001Web ProtocolsCommand and ControlT1071.002File Transfer ProtocolsCommand and ControlT1071.003Mail ProtocolsCommand and ControlT1071.004DNSCommand and ControlT1090.001Internal ProxyCommand and ControlT1090.002External ProxyCommand and ControlT1090.003Multi-hop ProxyCommand and ControlT1090.004Domain FrontingCommand and ControlT1095Non-Application Layer ProtocolCommand and ControlT1098.001Additional Cloud CredentialsPersistence, Privilege EscalationT1102Web ServiceCommand and ControlT1104Multi-Stage ChannelsCommand and ControlT1105Ingress Tool TransferCommand and ControlT1110.003Password SprayingCredential AccessT1110.004Credential StuffingCredential AccessT1132Data EncodingCommand and ControlT1185Browser Session HijackingCollectionT1189Drive-by CompromiseInitial AccessT1190Exploit Public-Facing ApplicationInitial AccessT1197BITS JobsExecution, Persistence, StealthT1199Trusted RelationshipInitial AccessT1204.001Malicious LinkExecutionT1205Traffic SignalingCommand and Control, Persistence, StealthT1205.001Port KnockingCommand and Control, Persistence, StealthT1207Rogue Domain ControllerDefense ImpairmentT1210Exploitation of Remote ServicesLateral MovementT1218.003CMSTPStealthT1219Remote Access ToolsCommand and ControlT1498.001Direct Network FloodImpactT1498.002Reflection AmplificationImpactT1499.002Service Exhaustion FloodImpactT1542.005TFTP BootPersistence, StealthT1546.003Windows Management Instrumentation Event SubscriptionPersistence, Privilege EscalationT1546.008Accessibility FeaturesPersistence, Privilege EscalationT1550.001Application Access TokenLateral MovementT1550.004Web Session CookieLateral MovementT1557Adversary-in-the-MiddleCollection, Credential AccessT1557.001Name Resolution Poisoning and SMB RelayCollection, Credential AccessT1557.003DHCP SpoofingCollection, Credential AccessT1558.003KerberoastingCredential AccessT1563Remote Service Session HijackingLateral MovementT1565.002Transmitted Data ManipulationImpact

Showing the first 60 of 72 source-derived relationships. Open the official D3FEND technique for the current graph view.

ATT&CK for ICS (18)
T0814Denial of ServiceInhibit Response Function
T0817Drive-by CompromiseInitial Access
T0819Exploit Public-Facing ApplicationInitial Access
T0822External Remote ServicesInitial Access
T0830Adversary-in-the-MiddleCollection
T0840Network Connection EnumerationDiscovery
T0842Network SniffingDiscovery
T0846Remote System DiscoveryDiscovery
T0848Rogue MasterInitial Access
T0865Spearphishing AttachmentInitial Access
T0866Exploitation of Remote ServicesInitial Access, Lateral Movement
T0869Standard Application Layer ProtocolCommand and Control
T0884Connection ProxyCommand and Control
T0885Commonly Used PortCommand and Control
T0886Remote ServicesInitial Access, Lateral Movement
T0888Remote System Information DiscoveryDiscovery
T0894System Binary Proxy ExecutionEvasion
T0895Autorun ImageExecution
Source record

Authoritative sources