tfMITRE ATT&CK sub-technique

Dead Drop Resolver T1102.001

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 14 March 2020
Last modified: 12 May 2026

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 18%

Tools & malware82nd percentile · 82% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Dead Drop Resolver MITRE reference T1102.001

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

RockeG0106 ↗

Has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.1

created 2020-05-261 reference

APT41G0096 ↗

Used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.1

created 2019-09-231 referenceaka Wicked Panda

KimsukyG0094 ↗

Has used TRANSLATEXT and a dead drop resolver to retrieve configurations and commands from a public blog site.1

created 2019-08-261 referenceaka Black Banshee

BRONZE BUTLERG0060 ↗

BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.1

created 2018-01-161 referenceaka REDBALDKNIGHT

RTMG0048 ↗

Has used an RSS feed on Livejournal to update a list of encrypted C2 server names.1

created 2017-05-311 reference

PatchworkG0040 ↗

Hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.1

created 2017-05-311 referenceaka Hangover Group

All 6 groups for this technique

Offense vs defense T1102.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2019 Q4 · 2 of 2 campaigns plotted

Dead Drop Resolver detection strategy DET0058

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Web Service: Dead Drop Resolver

Enterprise

4 platforms

AN0158 · Windows

Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	etw:Microsoft-Windows-NDIS-PacketCapture	TLS Handshake/Network Flow

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetDomain	FQDN or IP for the hosting site of the dead drop (e.g., pastebin.com, twitter.com)
TimeWindow	Defines how close in time the suspicious network and process behavior must occur
UserContext	Filter by user or system accounts to reduce noise

AN0159 · Linux

Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	auditd:SYSCALL	connect
Network Traffic ContentDC0085	NSM:Flow	HTTP/TLS Logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetDomain	Dead drop hosting domain (e.g., GitHub, Google Docs)
PayloadEntropyThreshold	Detects high entropy in payloads signaling obfuscation
TimeWindow	Causal proximity between access to resolver and follow-up connections

AN0160 · macOS

Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	macos:osquery	process_events/socket_events
Network Traffic ContentDC0085	macos:unifiedlog	subsystem: com.apple.network

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetService	Known services abused for D2 (e.g., iCloud, Dropbox)
UserContext	Useful to isolate rare users accessing web services for C2
TimeWindow	Max time gap between dead drop resolver fetch and follow-on traffic

AN0161 · ESXi

Detection of a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary C2 server (dead drop resolver behavior).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vobd	Network Events
Network Connection CreationDC0082	NSM:Firewall	Outbound Connections

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DestinationIP	Identifies unusual IP destinations embedded in traffic
Protocol	Used to detect uncommon protocols (e.g., DNS over HTTPS)
TimeWindow	Used to correlate outbound web requests with process execution

Dead Drop Resolver detections T1102.001

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

(none) 2

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs