Web Service: One-Way Communication T1102.003

Tactic: Command & Control

Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.

Events covered

2 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
ESFexecProcess Execution
ESFforkProcess Fork

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType2eq 1, in 1exec, fork, start, subscribe
c-uri2contains 2, match 1.ghostbin.co/paste/*/raw/, .hastebin.com/raw/, .paste.ee/r/, /pwndrop/
CommandLine1contains 1confirm=no_antivirus, drive.google.com, export=download
Provider_Name1eq 1sns.amazonaws.com
data_stream.dataset1eq 1aws.cloudtrail
event.outcome1eq 1success
process_name1eq 1brave.exe, browser.exe, chrome.exe

Top indicator values (38 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
CommandLinecontains
confirm=no_antivirus
1
CommandLinecontains
drive.google.com
1
CommandLinecontains
export=download
1
EventTypeeq
subscribe
1
EventTypein
exec
1206
EventTypein
fork
17
EventTypein
start
1168
Provider_Nameeq
sns.amazonaws.com
13
c-uricontains
.hastebin.com/raw/
1
c-uricontains
.paste.ee/r/
1
c-uricontains
.pastebin.com/raw/
1
c-uricontains
/pwndrop/
1
c-uricontains
paste.ee/
1
c-uricontains
pastebin.pl/
1
c-uricontains
pastetext.net/
1
c-urimatch
.ghostbin.co/paste/*/raw/
1
data_stream.dataseteq
aws.cloudtrail
1173
event.outcomeeq
success
1375
process_nameeq
brave.exe
17
process_nameeq
browser.exe
17
process_nameeq
chrome.exe
116
process_nameeq
curl
129
process_nameeq
curl.exe
134
process_nameeq
dragon.exe
17
process_nameeq
firefox
1
process_nameeq
firefox.exe
15
process_nameeq
google chrome
1
process_nameeq
google-chrome
1
process_nameeq
google-chrome-beta
1
process_nameeq
google-chrome-stable
1

Exclusions (1 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
aws::userAgentcontains
terraform
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 2 rules

Elastic 2 rules