Application-layer protocol abuse is the use of ordinary web, DNS, email, or SaaS API traffic to carry malicious commands, data, or callbacks. Instead of opening an unusual port or using a custom protocol, an attacker hides inside legitimate-looking requests such as HTTP posts, DNS lookups, or Microsoft Graph API calls. The traffic may be real protocol use, but the intent is covert.
This matters because security tools often trust common application traffic more than raw network anomalies. Abuse can blend into normal business activity, especially in cloud services where calendars, mail, files, and identity objects are routinely accessed. In defense, analysts look for odd API permissions, unusual request patterns, strange object changes, mismatched user agents, and DNS queries that do not fit normal application behavior. The goal is not to block the protocol, but to detect when a normal protocol is being used as a hidden control or exfiltration channel.