MITRE ATT&CKtechnique

T1102 Web Service

Published 2017-05-31 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.3
Created
2017-05-31

Description

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1031 Network Intrusion Prevention mitigation
  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

  • T1102.001 Dead Drop Resolver sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1102.003 One-Way Communication sub-technique

Referenced by MITRE ATT&CK · uses (51)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9044 Kali365 software (malware)
  • G1055 VOID MANTICORE group
  • S9031 AshTag software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9019 PureCrypter software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1221 MOPSLED software (malware)
  • G1044 APT42 group
  • S1178 ShrinkLocker software (malware)
  • G1039 RedCurl group
  • C0040 APT41 DUST campaign
  • S1160 Latrodectus software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1147 Nightdoor software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1124 SocGholish software (malware)
  • S0508 ngrok software (tool)
  • S1086 Snip3 software (malware)
  • S1081 BADHATCH software (malware)
  • C0027 C0027 campaign
  • S1066 DarkTortilla software (malware)
  • S1063 Brute Ratel C4 software (tool)
  • C0017 C0017 campaign
  • C0005 Operation Spalax campaign
  • S1039 Bumblebee software (malware)
  • G1011 EXOTIC LILY group
  • S0689 WhisperGate software (malware)
  • S0674 CharmPower software (malware)
  • G0140 LazyScripter group
Show all 51 ›

Referenced by Compliance · mitigates (13)

  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-9.3 Maintain and Enforce Network-Based URL Filters CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References