T1102.002sub-technique of T1102 Web Service
Bidirectional Communication
ESXi · Linux · macOS · Windowsnothing on this site yetT1102.002 on attack.mitre.org
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel.
how MITRE says to see it
Detect Bidirectional Web Service C2 Channels via Process & Network Correlation
- Suspicious processes initiating encrypted HTTPS connections to common web service domains, followed by abnormal data upload behavior or automated posting behavior indicative of C2 bidirectional traffic.
- Non-interactive system processes making encrypted HTTPS connections to well-known web services followed by high outbound traffic volume or scripted upload patterns.
- Scripting engines (e.g., osascript, Python) initiating HTTPS requests to social media or content-sharing platforms, paired with automated response handling indicative of two-way communication.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1021 Restrict Web-Based Content. Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.