THREATNOIR
Subscribe
MITRE ATT&CK · T1102

Web Service

MITRE · cited in 28 of our lessons

Explanation

What attackers do. Attackers use legitimate external web services, such as cloud storage, code hosting, social media or messaging platforms, to relay commands and data to compromised systems. Because traffic goes to trusted, widely used sites, it is hard to block. This serves Command and Control.

How to defend. Decide which web services the business actually needs and restrict the rest at the proxy, especially from servers. Use tenant restrictions where available so staff can only reach corporate instances of cloud services. Log proxy traffic with process attribution so you can see which program is talking to each service.

Signs to look for. Look for unusual processes connecting to cloud storage, paste sites or messaging APIs, regular polling to the same service, and access to personal rather than corporate tenants. The main gap is allowlisting popular domains entirely, which gives attackers a trusted channel.

Open the technique on MITRE ATT&CK
The official text
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 28.