T1102.003sub-technique of T1102 Web Service
One-Way Communication
Linux · macOS · Windows · ESXinothing on this site yetT1102.003 on attack.mitre.org
Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service.
how MITRE says to see it
Detect One-Way Web Service Command Channels
- Suspicious process initiating outbound connections to web services without corresponding response or return traffic, indicative of one-way command channels.
- Curl, wget, or custom HTTP clients initiated by uncommon user accounts or cron jobs to popular web services, with no observed response parsing logic.
- Process using URLSession or similar API to fetch from web services without any response handling, indicative of one-way C2 channels.
- ESXi shell or scheduled tasks initiating outbound HTTPS to known public services without inbound return or loggable response, used to fetch instructions.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1021 Restrict Web-Based Content. Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.