EXPLORE
← Back to Explore
T1102

Web Service

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: ...

ESXiLinuxWindowsmacOS
33
Detections
3
Sources
14
Threat Actors

BY SOURCE

16elastic13sigma4splunk_escu

PROCEDURES (24)

Download3 detections

Auto-extracted: 3 detections for download

Api3 detections

Auto-extracted: 3 detections for api

Phish2 detections

Auto-extracted: 2 detections for phish

Bypass2 detections

Auto-extracted: 2 detections for bypass

Dns2 detections

Auto-extracted: 2 detections for dns

Command And Control2 detections

Auto-extracted: 2 detections for command and control

Bypass2 detections

Auto-extracted: 2 detections for bypass

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Service1 detections

Auto-extracted: 1 detections for service

Network Connection Monitoring1 detections

Auto-extracted: 1 detections for network connection monitoring

Beacon1 detections

Auto-extracted: 1 detections for beacon

Beacon1 detections

Auto-extracted: 1 detections for beacon

Cloud1 detections

Auto-extracted: 1 detections for cloud

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Unusual1 detections

Auto-extracted: 1 detections for unusual

Remote1 detections

Auto-extracted: 1 detections for remote

Aws1 detections

Auto-extracted: 1 detections for aws

Dns1 detections

Auto-extracted: 1 detections for dns

Email1 detections

Auto-extracted: 1 detections for email

Cloud1 detections

Auto-extracted: 1 detections for cloud

Remote1 detections

Auto-extracted: 1 detections for remote

Tunnel1 detections

Auto-extracted: 1 detections for tunnel

C21 detections

Auto-extracted: 1 detections for c2

Command And Control1 detections

Auto-extracted: 1 detections for command and control

DETECTIONS (33)

AWS CLI Command with Custom Endpoint URL
elasticmedium
AWS SNS Rare Protocol Subscription by User
elasticlow
AWS SNS Topic Message Publish by Rare User
elasticmedium
Cloudflared Tunnel Connections Cleanup
sigmamedium
Cloudflared Tunnel Execution
sigmamedium
Communication To LocaltoNet Tunneling Service Initiated
sigmahigh
Communication To LocaltoNet Tunneling Service Initiated - Linux
sigmahigh
Communication To Ngrok Tunneling Service - Linux
sigmahigh
Communication To Ngrok Tunneling Service Initiated
sigmahigh
Connection to Common Large Language Model Endpoints
elasticmedium
Connection to Commonly Abused Web Services
elasticlow
Google Calendar C2 via Script Interpreter
elastichigh
Linux Ngrok Reverse Proxy Usage
splunk_escu
Linux Telegram API Request
elasticmedium
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
sigmamedium
Network Connection to OAST Domain via Script Interpreter
elastichigh
New Connection Initiated To Potential Dead Drop Resolver Domain
sigmahigh
Ngrok Reverse Proxy on Network
splunk_escu
Potential Etherhiding C2 via Blockchain Connection
elastichigh
Potentially Suspicious Network Connection To Notion API
sigmalow
Process Initiated Network Connection To Ngrok Domain
sigmahigh
Statistical Model Detected C2 Beaconing Activity
elasticlow
Statistical Model Detected C2 Beaconing Activity with High Confidence
elasticlow
Suspicious AWS S3 Connection via Script Interpreter
elasticmedium
Suspicious Child Process Of Manage Engine ServiceDesk
sigmahigh
Suspicious Curl to Google App Script Endpoint
elastichigh
Suspicious File Downloaded from Google Drive
elasticmedium
Suspicious Non-Browser Network Communication With Google API
sigmamedium
Suspicious Non-Browser Network Communication With Telegram API
sigmamedium
Unusual Network Connection to Suspicious Web Service
elasticmedium
Unusual Web Request
elasticlow
Windows Abused Web Services
splunk_escu
Windows Ngrok Reverse Proxy Usage
splunk_escu