tfMITRE ATT&CK sub-technique

One-Way Communication T1102.003

Tactic: Command and Control
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 14 March 2020
Last modified: 24 October 2025

Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

One-Way Communication MITRE reference T1102.003

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

LeviathanG0065 ↗

Has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.1

created 2018-04-181 referenceaka MUDCARP

Gamaredon GroupG0047 ↗

Has used Telegram Messenger content to discover the IP address for C2 communications.1

created 2017-05-311 referenceaka IRON TILDEN

All 2 groups for this technique

Offense vs defense T1102.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2019 Q4 · 1 of 1 campaigns plotted

One-Way Communication detection strategy DET0581

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect One-Way Web Service Command Channels

Enterprise

4 platforms

AN1599 · Windows

Suspicious process initiating outbound connections to web services without corresponding response or return traffic, indicative of one-way command channels.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	etw:Microsoft-Windows-WinINet	WinINet API telemetry

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DestinationDomain	Can tune for popular web services (e.g., googleapis.com, github.com) based on threat actor tooling
TimeWindow	May adjust temporal window to catch beaconing patterns (e.g., every 10-30 mins)
ProcessName	Environment-specific tuning to exclude expected update or telemetry tools

AN1600 · Linux

Curl, wget, or custom HTTP clients initiated by uncommon user accounts or cron jobs to popular web services, with no observed response parsing logic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	iptables:LOG	OUTBOUND

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcess	May tune to detect unknown parents like custom scripts or reverse shells
CommandLineArgs	May adjust based on known curl/wget C2 behaviors

AN1601 · macOS

Process using URLSession or similar API to fetch from web services without any response handling, indicative of one-way C2 channels.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	exec events
Network Traffic ContentDC0085	macos:unifiedlog	process, network

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Flag unexpected outbound activity from non-admin or system users
EntropyScore	Optional if script-based obfuscation is seen in web requests

AN1602 · ESXi

ESXi shell or scheduled tasks initiating outbound HTTPS to known public services without inbound return or loggable response, used to fetch instructions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:hostd	CLI network calls

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScheduledTaskName	Can tune for task names used to execute curl-based outbound requests
DestinationIP	Scoped by environment to exclude known legitimate CDNs

One-Way Communication detections T1102.003

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

(none) 2

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs