T1102
Web Service
ESXi · Linux · macOS · Windowsnothing on this site yetT1102 on attack.mitre.org
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
how MITRE says to see it
Suspicious Use of Web Services for C2
- Detects unusual outbound connections to web services from uncommon processes using SSL/TLS, particularly those exhibiting high outbound data volume or persistence.
- Detects command-line tools, agents, or scripts making outbound HTTPS connections to popular web services like Discord, Slack, Dropbox, or Graph API in an unusual context.
- Detects user agents or background services making unauthorized or unscheduled web API calls to cloud/web services over HTTPS.
- Detects guest VMs or management agents issuing HTTP(S) traffic to external services without a valid patch management or backup justification.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1021 Restrict Web-Based Content. Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.