Web Service
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Parent technique whose only expressible observable is already published under a child. Every analytic in DET0425 reduces to the same predicate — an uncommon process talking to a popular web service — and the one log source that carries both halves of that predicate in a single event is Sysmon EventID 22, which is exactly the rule published for T1102.002 (logsource category dns_query / product windows; Image|endswith a script-host and LOLBAS list AND QueryName|endswith a web-service domain list). A parent rule on that source would be the same fields, the same values and the same events under a tag that describes the behaviour less precisely. The remaining sources cannot carry it. […]
What the technique is
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1189
Detects unusual outbound connections to web services from uncommon processes using SSL/TLS, particularly those exhibiting high outbound data volume or persistence.
- AN1190
Detects command-line tools, agents, or scripts making outbound HTTPS connections to popular web services like Discord, Slack, Dropbox, or Graph API in an unusual context.
- AN1191
Detects user agents or background services making unauthorized or unscheduled web API calls to cloud/web services over HTTPS.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.