Pub/Sub Protocol C2 via MQTT or AMQP from Desktop Endpoints (T1071.005)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•1•0•4

Detects outbound network connections from workstations or servers to common message broker ports (MQTT 1883/8883, AMQP 5672). These protocols are sometimes abused for command-and-control (C2) communication, as they allow for pub/sub messaging patterns that can blend into legitimate network traffic.