T1102 Web Service — ATT&CK Technique
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Detection coverage (17)
- Communication To Ngrok Tunneling Service - Linux high
- Communication To LocaltoNet Tunneling Service Initiated - Linux high
- Network Connection Initiated To AzureWebsites.NET By Non-Browser Process medium
- Process Initiated Network Connection To Ngrok Domain high
- Potentially Suspicious Network Connection To Notion API low
- Suspicious Non-Browser Network Communication With Google API medium
- Suspicious Non-Browser Network Communication With Telegram API medium
- New Connection Initiated To Potential Dead Drop Resolver Domain high
- Communication To LocaltoNet Tunneling Service Initiated high
- Communication To Ngrok Tunneling Service Initiated high
- Cloudflared Tunnel Execution medium
- Cloudflared Tunnel Connections Cleanup medium
- Suspicious Child Process Of Manage Engine ServiceDesk high
- Linux Ngrok Reverse Proxy Usage
- Windows Ngrok Reverse Proxy Usage
- Ngrok Reverse Proxy on Network
- Windows Abused Web Services
Malware using this technique
- Nightdoor
- Latrodectus
- Snip3
- Raspberry Robin
- Carbon
- PureCrypter
- AshTag
- BoomBox
- SharpStage
- SMOKEDHAM
- DropBook
- Bumblebee
- RedLine Stealer
- ShrinkLocker
- Hildegard
- Brute Ratel C4
- BADHATCH
- Sibot
- NETWIRE
- CharmPower
- WhisperGate
- ngrok
- DarkTortilla
- Doki
- MOPSLED
- CHIMNEYSWEEP
- BRICKSTORM
- GuLoader
- Bazar
- SocGholish