Mafalda.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

Metador has used TCP for C2.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Metador has used HTTP for C2.(Citation: SentinelLabs Metador Sept 2022)|