Dead Drop Resolver
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likeliho...
BY SOURCE
PROCEDURES (7)
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for service