Web Protocols are the network rules and formats used to exchange data between browsers, applications and servers over the web. Attackers abuse them for command-and-control, data theft and phishing through ordinary-looking traffic, so defenders should inspect HTTP and HTTPS behaviour, certificate use, user agents, destination patterns and unusual outbound requests.
What Web Protocols Actually Do
Web protocols define how browsers, apps, and servers format requests, carry responses, and maintain trust across the web. They are the basic transport and application rules behind ordinary browsing, but that same normality also makes them attractive for abuse.
Why Web Traffic Is Easy to Abuse
Attackers often hide malicious activity inside common web exchanges because HTTP and HTTPS are ubiquitous, allowed in most environments, and rarely blocked outright. That means defenders need to treat normal-looking destinations, headers, certificate choices, and request cadence as security signals, not just connectivity details.
Protocol abuse is often less about breaking the protocol itself and more about blending hostile activity into expected client-server behaviour. A request that looks like routine browsing can still carry command-and-control traffic, exfiltration, phishing redirects, or staging for later compromise.
What Defenders Should Examine
Useful inspection starts with the full web session, not just the URL. User agents, hostnames, SNI and certificate patterns, response codes, redirect chains, download behaviour, and outbound request frequency can reveal whether a browser-like conversation is actually supporting a different purpose.
That also means baselining destination patterns and comparing them with the organisation’s approved web use. Unexpected geographies, newly registered domains, unusual paths, or repeated low-volume callbacks can all indicate abuse of web protocols for persistence or covert signalling.
When protocol analysis is part of a broader monitoring stack, authoritative registries help keep protocol, port, and identifier handling consistent. IANA is the canonical reference for many of those assignments, which matters when you are validating whether traffic is using expected web-related values or something unusual.
Why Certificates and Request Context Matter
HTTPS protects confidentiality in transit, but it does not prove benign intent. A valid certificate can coexist with phishing, malware delivery, or data theft, so defenders should correlate certificate legitimacy with destination reputation, hostname consistency, and whether the traffic matches the user or workload’s normal role.
Request context also matters because web protocols often carry identity-like signals indirectly, such as session state, cookies, tokens, and authenticated browser flows. If an attacker steals or reuses that context, the protocol itself becomes the delivery path for impersonation, exfiltration, or unauthorized actions.
Risk and Threat Considerations
Web protocols are high-value abuse channels because they are trusted, noisy, and hard to distinguish from legitimate traffic at scale. That makes them useful for stealthy command-and-control, phishing infrastructure, credential theft, and data exfiltration, especially when defenders focus only on reputation or simple allowlists.
Failure mechanism: Hostile traffic inherits the legitimacy of normal web browsing, then uses redirects, encrypted sessions, and familiar headers to avoid detection while maintaining external control or moving stolen data out of the environment.
Impact: Compromised systems can leak credentials, session material, source code, business data, or internal browsing context, and the attacker may retain access through ordinary web channels even after the initial intrusion is discovered.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1071.001 — Application Layer Protocol: Web Protocols | Covers adversary use of web protocols for command-and-control and covert traffic. |
| T1105 — Ingress Tool Transfer | Explains how web protocols carry payload delivery and staging activity into environments. | |
| Recommendation — Map suspicious web traffic to T1071.001 and hunt for beaconing, redirects, and staged exfiltration. Inspect web downloads and transfer patterns for staged tools, droppers, and payload retrieval. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | Web protocol abuse is detected through continuous monitoring of network behaviour and destinations. |
| Recommendation — Monitor HTTP and HTTPS behaviour continuously and alert on abnormal destinations, cadence, and certificates. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Web protocol investigations depend on logs that preserve request, destination, and session context. |
| SC-7 — Boundary Protection | Web protocols cross trust boundaries and require controlled inspection at the network edge. | |
| Recommendation — Log web request metadata, redirects, and authentication context for later investigation. Inspect and control web traffic at boundaries to reduce exposure to covert web-based abuse. | ||
Related resources from NHI Mgmt Group
- Why does relying on legacy authentication protocols create more identity management complexity than web based SSO?
- Why do legacy protocols increase NHI risk?
- How should security teams govern application proxy access for internal web apps?
- How should security teams reduce the impact of an unauthenticated RCE in a web framework?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org