Web Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: ...
BY SOURCE
PROCEDURES (24)
Auto-extracted: 3 detections for bypass
Auto-extracted: 3 detections for api
Auto-extracted: 2 detections for command and control
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for dns
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for beacon
Auto-extracted: 1 detections for beacon
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for email