VOID MANTICOREG1055 ↗
tfMITRE ATT&CK technique
Web Service T1102
- Tactic
- Command and Control
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.3
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Anastasios Pingios; Sarathkumar Rajendran, Microsoft Defender365
Sub-techniques 325 rules across the family · 17 mapped directly to T1102 · 3 of 3 carry rules
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.[1] Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
15
Threat groupsTop 12%
Threat groups88th percentile · 88% of ATT&CK techniques have this many threat groups attributed or fewer.4
CampaignsTop 10%
Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.31
Tools & malwareTop 12%
Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.17
Detection rulesTop 15%
Detection rules85th percentile · 85% of ATT&CK techniques have this many detection rules written or fewer.Web Service MITRE reference T1102
Top 12%of all ATT&CK techniques for number of groups
15 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT42G1044 ↗
Has used various links, such as links with typo-squatted domains, links to Dropbox files and links to fake Google sites, in spearphishing operations.123
RedCurlG1039 ↗
EXOTIC LILYG1011 ↗
Has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.1
LazyScripterG0140 ↗
Has used GitHub to host its payloads to operate spam campaigns.1
TeamTNTG0139 ↗
Has leveraged iplogger.org to send collected data back to C2.12
All 15 groups for this technique · 6 newest in this preview
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
APT41 DUSTC0040 ↗
Used compromised Google Workspace accounts for command and control.1
C0027C0027 ↗
During C0027, Scattered Spider downloaded tools from sites including file.io, GitHub, and paste.ee.1
C0017C0017 ↗
During C0017, APT41 used the Cloudflare services for C2 communications.1
Operation SpalaxC0005 ↗
During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.1
All 4 campaigns for this technique
31 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has used Cloudflare Workers to redirect traffic and to host malicious phishing pages.123 Kali365 has also leveraged Telegram chat to facilitate administrative tasks for the panel across affiliate users.143
AshTagS9031 ↗
Can download malicious payloads from file sharing services.1
PureCrypterS9019 ↗
Can use Telegram or Discord to send infection status messages.1
BRICKSTORMS9015 ↗
Has leveraged DNS web services to resolve C2 IP addresses including sslip.io and nip.io.1 BRICKSTORM has also utilized Cloudflare Workers for C2 communications.1
RedLine StealerS1240 ↗
Has leveraged legitimate file sharing web services to host malicious payloads.12
MOPSLEDS1221 ↗
Can use third-party web services such as GitHub and Google Drive for C2.1
All 31 software entries for this technique · 6 newest in this preview
Offense vs defense T1102
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 4Sigma rules (cumulative) · 13Splunk ESCU (cumulative) · 4
first rule: 2021 Q4 · 4 of 4 campaigns plottedWeb Service detection strategy DET0425
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Suspicious Use of Web Services for C2
4 platforms
AN1189 · Windows
Detects unusual outbound connections to web services from uncommon processes using SSL/TLS, particularly those exhibiting high outbound data volume or persistence.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | SSL/TLS Inspection or PCAP |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessName | To tune for unexpected or uncommon executables initiating network connections |
| DataTransferThreshold | Volume of outbound data in short time window (e.g., >1MB in <5 min) |
| TimeWindow | Look for connections persisting outside of normal business hours |
AN1190 · Linux
Detects command-line tools, agents, or scripts making outbound HTTPS connections to popular web services like Discord, Slack, Dropbox, or Graph API in an unusual context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Connection CreationDC0082 | auditd:SYSCALL | connect/sendto |
| Network Traffic ContentDC0085 | NSM:Flow | conn.log, ssl.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcess | Unusual parent-child process behavior initiating external comms (e.g., bash > curl) |
| HostnamePattern | Destination hostnames (e.g., *.dropboxapi.com, *.graph.microsoft.com) |
| RequestFrequency | Repeated requests at unusual intervals, suggesting beaconing |
AN1191 · macOS
Detects user agents or background services making unauthorized or unscheduled web API calls to cloud/web services over HTTPS.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Connection CreationDC0082 | macos:osquery | process_events, socket_events |
| Network Traffic ContentDC0085 | macos:unifiedlog | process + network activity |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessSignature | Unsigned or user-modified apps communicating with cloud services |
| ConnectionInterval | Beacon-like pattern of regular outbound communication |
AN1192 · ESXi
Detects guest VMs or management agents issuing HTTP(S) traffic to external services without a valid patch management or backup justification.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | vpxd.log | API communication |
| Network Connection CreationDC0082 | esxi:vmkernel | network activity |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RemoteIPRange | Filter to detect only external/public destinations |
| VMContext | Exclude known backup or patch automation services |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.