SOAP over HTTP is a web service communication method that sends structured messages through standard HTTP requests. Malware authors sometimes use it for command and control because it can blend into normal traffic patterns while still allowing detailed tasking and data exchange.
What SOAP over HTTP Is
SOAP over HTTP is a structured web service transport pattern, not just a generic web request. The SOAP envelope carries the message semantics, while HTTP provides a widely accepted delivery path that often blends in with ordinary enterprise traffic and proxy traversal.
That normality is part of why the format matters in security work. A message can look like routine application traffic at the transport layer even when the payload contains tightly structured tasking, status data, or staged commands.
Why SOAP over HTTP Matters in Web Service Security
In legitimate environments, SOAP over HTTP supports interoperability between business systems that need formal request and response structures, explicit schemas, and predictable message handling. The combination is common in older service-oriented architectures, integration layers, and enterprise middleware.
From a security perspective, the key issue is that transport convenience can obscure content intent. Defensive teams need to understand both layers: HTTP for routing and visibility, SOAP for the application-level semantics that actually determine what the service is doing.
That distinction is important because network tools may see only a standard HTTP exchange unless they inspect the SOAP body, headers, and endpoint behavior. For deeper protocol context, the original SOAP 1.2 specification remains the clearest reference for message structure.
How SOAP over HTTP Is Abused for Command and Control
Threat actors can abuse SOAP over HTTP because it inherits the legitimacy of both SOAP-based enterprise traffic and ordinary HTTP delivery. That makes it attractive for command and control channels, especially when defenders are tuned to block obviously unusual protocols but allow standard web traffic.
Abuse usually relies on concealment rather than protocol novelty. The attacker benefits when requests look operationally routine, when endpoints are predictable, and when response content can be shaped to carry instructions, status updates, or exfiltrated data without triggering simple controls.
The traffic pattern also helps when organizations whitelist service endpoints or assume that web service calls are business-critical and therefore low-risk. That trust can reduce scrutiny unless payload inspection, endpoint allowlisting, and behavioral analytics are in place.
Detection and Defensive Analysis of SOAP over HTTP
Security teams should treat SOAP over HTTP as application-layer traffic that deserves content awareness, not just port-based approval. Detection is stronger when defenders correlate the HTTP endpoint, SOAP action, schema expectations, message size, frequency, and source system behavior.
Useful analysis often depends on spotting what is unusual for the service rather than what is unusual for HTTP in general. A request may be syntactically valid while still being operationally suspicious if it uses atypical operations, abnormal parameter values, or repetitive polling patterns that resemble a beacon.
Broader monitoring guidance from NIST Cybersecurity Framework 2.0 and control-oriented hygiene from CIS Controls v8 are both relevant when SOAP endpoints carry business and security significance.
Operational Context and Common Misconceptions
A common mistake is to treat SOAP over HTTP as inherently safe because it uses HTTP, or inherently obsolete because it is an older integration style. Neither assumption is reliable. The security posture depends on who can reach the endpoint, what the service accepts, and whether the payloads are validated and monitored.
Another misconception is that protocol familiarity implies trustworthiness. Many enterprise systems still depend on SOAP interfaces, so defenders need to distinguish stable business integrations from traffic that simply imitates them. That makes inventory, ownership, and endpoint documentation as important as packet inspection.
Where service endpoints expose privileged operations, controls around access, message integrity, and logging become especially important. In cloud and platform environments, the CSA Cloud Controls Matrix is a useful control map for IAM, logging, and secure configuration expectations that often surround service interfaces.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API8 — Security Misconfiguration | SOAP over HTTP abuse often depends on exposed or weakly governed service endpoints. |
| Recommendation — Harden SOAP endpoints and remove unnecessary exposure, defaulting to explicit access control and validation. | ||
| MITRE ATT&CK | T1071.001 — Application Layer Protocol: Web Protocols | SOAP over HTTP is a web-protocol channel that adversaries can use to blend C2 into normal traffic. |
| Recommendation — Hunt for web-protocol beaconing and inspect suspicious SOAP payload patterns in traffic analytics. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | SOAP-over-HTTP abuse is best surfaced through monitoring of service behavior and network flow anomalies. |
| Recommendation — Monitor SOAP services for abnormal request rates, message shapes, and unexpected endpoints. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events | SOAP over HTTP requires monitoring of service traffic to spot misuse hidden inside routine web flows. |
| PR.AA-05 — Access permissions and authorizations are managed, enforced, and reviewed | SOAP services commonly expose business actions that should be gated by explicit authorization. | |
| Recommendation — Monitor service traffic so suspicious SOAP activity is detected as a cybersecurity event. Enforce and review authorization on SOAP operations and sensitive service actions. | ||
Related resources from NHI Mgmt Group
- How should security teams decide between WinRM over HTTP and HTTPS?
- What do teams get wrong about WinRM over HTTP security?
- When should teams prioritise HTTP/2 end-to-end over mixed protocol support?
- What is the difference between running MCP locally over stdio and exposing it as a remote HTTP service?
