T1102.001sub-technique of T1102 Web Service
Dead Drop Resolver
ESXi · Linux · macOS · Windowsnothing on this site yetT1102.001 on attack.mitre.org
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
how MITRE says to see it
Detection Strategy for Web Service: Dead Drop Resolver
- Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).
- Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).
- Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).
- Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1021 Restrict Web-Based Content. Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.