T1102 Web Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- PwnDrp Accesscriticaltest · proxy
- Communication To LocaltoNet Tunneling Service Initiatedhightest · windows
- Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest · linux
- Communication To Ngrok Tunneling Service - Linuxhightest · linux
- Communication To Ngrok Tunneling Service Initiatedhightest · windows
- New Connection Initiated To Potential Dead Drop Resolver Domainhightest · windows
- Process Initiated Network Connection To Ngrok Domainhightest · windows
- Raw Paste Service Accesshightest · proxy
- Suspicious Child Process Of Manage Engine ServiceDeskhightest · windows
- Cloudflared Tunnel Connections Cleanupmediumtest · windows
- Cloudflared Tunnel Executionmediumtest · windows
- Github Self-Hosted Runner Executionmediumtest · windows
- Network Connection Initiated To AzureWebsites.NET By Non-Browser Processmediumtest · windows
- Suspicious Non-Browser Network Communication With Telegram APImediumtest · windows
- Telegram API Accessmediumtest · proxy
- Telegram Bot API Requestmediumtest · dns
- Suspicious Non-Browser Network Communication With Google APImediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.