Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1102 | Web Service |
Comments
Adversaries use external Web services as command-and-control infrastructure. Dedicated administrative systems have no direct Internet access, directly preventing them from establishing command-and-control sessions with external Web services.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1102 | Web Service |
Comments
Web proxies and application-layer gateways can restrict access to unauthorized external web services, limiting their use for adversary command and control.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1102 | Web Service |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block identifiable command-and-control traffic using web services.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1102 | Web Service |
Comments
An application-aware or destination-restricted endpoint firewall can block unauthorized web, cloud, file-sharing, or social-media services used for command and control.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1102 | Web Service |
Comments
CIS 9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery. If 9.3 implementation includes certain risky or suspicious web-services used broadly enough to block unauthorized services, then this technique is applicable.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Evade Defenses | Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. | related-to | T1102 | Web Service | |
| action.hacking.vector.Other network service | Network service that is not remote access or a web application. | related-to | T1102 | Web Service | |
| action.malware.variety.C2 | Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. | related-to | T1102 | Web Service |
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1102.003 | One-Way Communication | 4 |
| T1102.002 | Bidirectional Communication | 4 |
| T1102.001 | Dead Drop Resolver | 6 |