Web Service `T1102`

Tactic: Command & Control

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Events covered

20 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 22	DNSEvent (DNS query)
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	Event ID 5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	Event ID 5159	The Windows Filtering Platform has blocked a bind to a local port.
Defender-AlertEvidence	any	Alert evidence
Defender-DeviceEvents	BrowserLaunchedToOpenUrl	Browser launched to open URL
Defender-EmailEvents	any	Email processed
Defender-IdentityInfo	any	Identity information
ESF	exec	Process Execution
ESF	fork	Process Fork
ESF	write	File Write
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 3	Network connection

Authoring guide

These 72 rules share fields, values, and exclusions.

Fields filtered most (73 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`process_name`	27	`in` 11, `eq` 9, `starts_with` 6, `wildcard` 5, `is_not_null` 3, `contains` 2, `ne` 1	`bash`, `busybox`, `node`, `.*`, `python`
`EventType`	20	`eq` 15, `in` 4, `ne` 1	`exec`, `lookup_result`, `start`, `exec_event`, `ProcessRollup2`
`DestinationHostname`	18	`contains` 8, `ends_with` 7, `starts_with` 2, `wildcard` 2, `eq` 1, `in` 1, `is_not_null` 1, `is_null` 1	`.localto.net`, `.localtonet.com`, `tunnel.ap.ngrok.com`, `tunnel.au.ngrok.com`, `tunnel.eu.ngrok.com`
`Image`	16	`ends_with` 8, `wildcard` 8, `eq` 5, `starts_with` 5, `contains` 3, `is_null` 3	`./`, `/boot/`, `/dev/shm/*`, `\appdata\local\discord\`, `\appdata\local\flock\`
`QueryName`	16	`wildcard` 7, `is_not_null` 6, `ends_with` 4, `in` 2, `contains` 1, `ne` 1	`.4shared.com`, `.aternos.me`, `.geojs.io`, `.2miners.com`, `*.antpool.com`
`event.type`	14	`eq` 14	`start`, `creation`
`host.os.type`	13	`eq` 11, `in` 2
`CommandLine`	10	`contains` 8, `in` 2	`tunnel` , `--config`, `authtoken`, `http`, `-config`
`Initiated`	5	`eq` 5	`true`
`DvcAction`	3	`eq` 1, `in` 1, `starts_with` 1	`1`, `3`, `BLOCK_`, `none`
`EventID`	3	`eq` 3	`22`, `4688`
`OriginalFileName`	3	`eq` 3	`bitsadmin.exe`, `certutil.exe`, `cmstp.exe`, `cscript.exe`, `installutil.exe`
`event.category`	3	`eq` 3	`network`, `process`
`process.args`	3	`eq` 3	`--endpoint-url`, `-clsid:{0002df01-0000-0000-c000-000000000046}`, `tunnel`
`CurrentDirectory`	2	`starts_with` 1, `wildcard` 1	`/boot`, `/boot`, `/dev/shm`, `/dev/shm`, `/home//`

Top indicator values (1601 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticAttempt to establish VScode Remote Tunnel elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticGoogle Calendar C2 via Script Interpreter elasticLinux Telegram API Request elasticNetwork Connection to OAST Domain via Script Interpreter elasticPotential Etherhiding C2 via Blockchain Connection elasticSuspicious AWS S3 Connection via Script Interpreter elasticSuspicious Curl to Google App Script Endpoint elasticUnusual Network Connection to Suspicious Web Service	13	1078
`process_name`	`in`	`curl` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticLinux Telegram API Request elasticSuspicious Curl to Google App Script Endpoint	8	89
`process_name`	`in`	`bash` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticPotential Etherhiding C2 via Blockchain Connection	7	202
`process_name`	`in`	`sh` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticPotential Etherhiding C2 via Blockchain Connection	7	197
`process_name`	`in`	`wget` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticLinux Telegram API Request	7	46
`process_name`	`in`	`zsh` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticPotential Etherhiding C2 via Blockchain Connection	7	196
`process_name`	`in`	`busybox` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	68
`process_name`	`in`	`csh` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	159
`process_name`	`in`	`dash` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	170
`process_name`	`in`	`env` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	17
`process_name`	`in`	`fish` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	163
`process_name`	`in`	`ksh` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	163
`process_name`	`in`	`tcsh` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	156
`process_name`	`in`	`timeout` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	15
`Image`	`wildcard`	`/tmp/*` elasticConnection to Common Large Language Model Endpoints elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	7	33
`Image`	`wildcard`	`/var/tmp/*` elasticConnection to Common Large Language Model Endpoints elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	7	31
`Image`	`wildcard`	`./*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	17
`Image`	`wildcard`	`/boot/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	21
`Image`	`wildcard`	`/dev/shm/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	29
`Image`	`wildcard`	`/home//` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	23
`Image`	`wildcard`	`/lost+found/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	10
`Image`	`wildcard`	`/proc/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	10
`Image`	`wildcard`	`/root/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	13
`Image`	`wildcard`	`/run/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	17
`Image`	`wildcard`	`/sys/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	10
`Image`	`wildcard`	`/var/mail/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	10
`Image`	`wildcard`	`/var/run/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	11
`Image`	`wildcard`	`/var/www/*` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	13
`EventType`	`eq`	`exec` elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service elasticNetwork Connection to OAST Domain via Script Interpreter	6	576
`EventType`	`eq`	`lookup_result` elasticDNS Request by Recently Created Executable elasticDNS Request to Crypto Miner Service elasticDNS Request to Crypto/DHT Services elasticDNS Request to Dynamic DNS via Suspicious Executable elasticDNS Request to IP Lookup Service from Suspicious Working Directory elasticDNS Request to Suspicious File Upload/Download Service	6	9

Exclusions (496 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`ends_with`	`\brave.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\maxthon.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\msedge.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\msedgewebview2.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\opera.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\safari.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\seamonkey.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\vivaldi.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\whale.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`Image`	`ends_with`	`\windowsapps\microsoftedge.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Google API sigmaSuspicious Non-Browser Network Communication With Telegram API	5
`process.code_signature.trusted`	`eq`	`true` elasticConnection to Common Large Language Model Endpoints elasticConnection to Commonly Abused Web Services elasticConnection to WebService by a Signed Binary Proxy elasticConnection to WebService by an Unsigned Binary elasticUnusual Network Connection to Suspicious Web Service	5
`Image`	`eq`	`c:\program files (x86)\google\chrome\application\chrome.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Telegram API	4
`Image`	`eq`	`c:\program files (x86)\internet explorer\iexplore.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Telegram API	4
`Image`	`eq`	`c:\program files (x86)\microsoft\edge\application\msedge.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Telegram API	4
`Image`	`eq`	`c:\program files (x86)\mozilla firefox\firefox.exe` sigmaNetwork Connection Initiated To AzureWebsites.NET By Non-Browser Process sigmaNew Connection Initiated To Potential Dead Drop Resolver Domain sigmaPotentially Suspicious Network Connection To Notion API sigmaSuspicious Non-Browser Network Communication With Telegram API	4

Web Service `T1102`

Events covered

Authoring guide

Fields filtered most (73 distinct)

Top indicator values (1601 distinct)

Exclusions (496 distinct)

Rules under this technique

Sigma 19 rules

Elastic 30 rules

Splunk 6 rules

Kusto 17 rules

Web Service T1102

Events covered

Authoring guide

Fields filtered most (73 distinct)

Top indicator values (1601 distinct)

Exclusions (496 distinct)

Rules under this technique

Sigma 19 rules

Elastic 30 rules

Splunk 6 rules

Kusto 17 rules

Web Service `T1102`