MITRE ATT&CKsub-technique

T1102.001 Dead Drop Resolver

Published 2020-03-14 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.2
Created
2020-03-14

Description

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1102 Web Service technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1031 Network Intrusion Prevention mitigation
  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · uses (28)

  • S9050 Vidar software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • S9034 Tsundere Botnet software (malware)
  • S9010 GlassWorm software (malware)
  • C0057 3CX Supply Chain Attack campaign
  • S1221 MOPSLED software (malware)
  • S1201 TRANSLATEXT software (malware)
  • S1051 KEYPLUG software (malware)
  • C0017 C0017 campaign
  • S0674 CharmPower software (malware)
  • S0531 Grandoreiro software (malware)
  • S0528 Javali software (malware)
  • S0518 PolyglotDuke software (malware)
  • G0106 Rocke group
  • S0455 Metamorfo software (malware)
  • G0096 APT41 group
  • G0094 Kimsuky group
  • S0373 Astaroth software (malware)
  • S0341 Xbash software (malware)
  • G0060 BRONZE BUTLER group
  • G0040 Patchwork group
  • G0048 RTM group
  • S0013 PlugX software (malware)
  • S0051 MiniDuke software (malware)
  • S0069 BLACKCOFFEE software (malware)
  • S0128 BADNEWS software (malware)
  • S0148 RTM software (malware)

Referenced by Compliance · mitigates (12)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-9.3 Maintain and Enforce Network-Based URL Filters CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References