- Engineer — Learn: MQTT as a C2 channel is an emerging evasion technique worth noting for threat modeling — if you run MQTT brokers or IoT infrastructure, review whether outbound MQTT to external brokers is permitted and consider blocking or monitoring it.
- SOC/IR — Plan: Build or tune detections for MQTT (port 1883/8883) traffic from endpoints to external brokers as a C2 indicator; the summary lacks published IOCs, but MQTT is not typically monitored in most SIEM/EDR rulesets and this framework’s activity dates to 2023.
- Leader — Skip