Drive-by Compromise T1189
Tactic: Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
Events covered
9 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 22 | DNSEvent (DNS query) |
| Sysmon | Event ID 23 | FileDelete (File Delete archived) |
| Sysmon | Event ID 26 | FileDeleteDetected (File Delete logged) |
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-UrlClickEvents | any | URL click activity |
| ESF | exec | Process Execution |
Authoring guide
These 52 rules share fields, values, and exclusions.
Fields filtered most (72 distinct)
These fields appear most often in rule filters.
Top indicator values (224 distinct)
These values appear most often in rule predicates.
Exclusions (52 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- Cross Site Scripting Strings
- Flash Player Update from Suspicious Location
- Suspicious Browser Child Process - MacOS
Elastic 12 rules
- Potential Browser Exploit via Fake RPC Messages
- Potential DNS Rebinding from Public to Private Address
- Potential Execution via Foxmail Exploitation
- Potential Fake CAPTCHA Phishing Attack
- Potential Masquerading as Business App Installer
- Potential Shellcode Injection by a Browser Process
- Suspicious Browser Child Process
- Suspicious Execution via Microsoft OfficeCmd URL Handler
- Suspicious VirtualProtect via Jscript9 from Internet Explorer
- Unusual Web Request
- WPS Office Exploit via DLL Hijack
- WPS Office Exploitation via DLL Hijack
Splunk 2 rules
- Detect hosts connecting to dynamic domain providers
- Splunk XSS Privilege Escalation via Custom Urls in Dashboard
Kusto 35 rules
- A client made a web request to a potentially harmful file (ASIM Web Session schema)
- Apache - Request to sensitive files
- App Gateway WAF - XSS Detection
- Application Gateway WAF - XSS Detection
- Box - Executable file in folder
- Box - Forbidden file type downloaded
- Cisco Cloud Security - Request to blocklisted file type
- Cisco SDWAN - Intrusion Events
- Cisco SDWAN - IPS Event Threshold
- Cisco WSA - Internet access from public IP
- Cisco WSA - Multiple attempts to download unwanted file
- Cisco WSA - Multiple errors to resource from risky category
- Cisco WSA - Multiple infected files
- Cisco WSA - Unexpected file type
- Cisco WSA - Unscannable file or scan error
- Critical Risks
- CTE - Blocked URL Attempted
- CTE - CTI Blocked URL Attempted
- CTE - Device Repeatedly Blocked Across Multiple Days
- CTE - Risky Device (Multiple IOC URL Hits)
- CTE - Sudden Block Spike Detected
- Front Door Premium WAF - XSS Detection
- Malformed user agent
- McAfee ePO - Multiple threats on same host
- McAfee ePO - Threat was not blocked
- New UserAgent observed in last 24 hours
- NGINX - Request to sensitive files
- Oracle - Request to sensitive files
- Power Apps - Multiple users access a malicious link after launching new app
- RecordedFuture Threat Hunting Hash All Actors
- SlackAudit - Suspicious file downloaded.
- Tomcat - Request to sensitive files
- Vulerabilities
- Web sites blocked by Eset
- Website blocked by ESET