Cross-source coverage

T1102.002 / ATT&CK

Web Service: Bidirectional Communication

20 rules across 5 sources.

Showing atomic-IOC rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonetw:Microsoft-Windows-WinINetauditd:SYSCALLNSM:Flowmacos:unifiedlogNSM:Connections

How MITRE says to detect it DET0035

Detect Bidirectional Web Service C2 Channels via Process & Network Correlation

Windows Analytic 0100

Suspicious processes initiating encrypted HTTPS connections to common web service domains, followed by abnormal data upload behavior or automated posting behavior indicative of C2 bidirectional traffic.

  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=1
  • etw:Microsoft-Windows-WinINet HTTPS Inspection

Linux Analytic 0101

Non-interactive system processes making encrypted HTTPS connections to well-known web services followed by high outbound traffic volume or scripted upload patterns.

  • auditd:SYSCALL execve
  • NSM:Flow conn.log
  • NSM:Flow ssl.log

macOS Analytic 0102

Scripting engines (e.g., osascript, Python) initiating HTTPS requests to social media or content-sharing platforms, paired with automated response handling indicative of two-way communication.

  • macos:unifiedlog log stream --info --predicate 'subsystem == "com.apple.cfprefsd"'
  • NSM:Connections web domain alerts

View on attack.mitre.org ↗

elastic/detection-rules

10 rules
Detection Severity Format
Google Calendar C2 via Script Interpreter High Elastic TOML
Potential Etherhiding C2 via Blockchain Connection High Elastic TOML
Suspicious Curl to Google App Script Endpoint High Elastic TOML
AWS CLI Command with Custom Endpoint URL Medium Elastic TOML
Connection to Common Large Language Model Endpoints Medium Elastic TOML
Linux Telegram API Request Medium Elastic TOML
Connection to Commonly Abused Web Services Low Elastic TOML
DNS Request to Suspicious Top Level Domain Low Elastic TOML
Statistical Model Detected C2 Beaconing Activity Low Elastic TOML
Statistical Model Detected C2 Beaconing Activity with High Confidence Low Elastic TOML

SigmaHQ/sigma

4 rules
Detection Severity Format
Github Self-Hosted Runner Execution Medium Sigma
Potentially Suspicious Azure Front Door Connection Medium Sigma
Telegram API Access Medium Sigma
Telegram Bot API Request Medium Sigma

Azure/Azure-Sentinel

2 rules
Detection Severity Format
CreepyDrive request URL sequence High KQL
CreepyDrive URLs High KQL

elastic/protections-artifacts

2 rules
Detection Severity Format
Attempt to establish VScode Remote Tunnel Undefined Elastic TOML
Potential VScode Remote Tunnel Established Undefined Elastic TOML

splunk/security_content

2 rules
Detection Severity Format
Potential Telegram API Request Via CommandLine Undefined SPL
Windows DNS Query Request by Telegram Bot API Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.