Winter VivernG1035 ↗
Created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.1
tfMITRE ATT&CK technique
Drive-by Compromise T1189
- Tactic
- Initial Access
- Platforms
- Identity Provider, Linux, macOS, Windows
- Version
- 1.7
- Created
- 18 April 2018
- Last modified
- 24 October 2025
- Contributors
- Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services); Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC); Frank Angiolelli
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
31
Threat groupsTop 5%
Threat groups95th percentile · 95% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.10
Tools & malware74th pct
Tools & malware74th percentile · 74% of ATT&CK techniques have this many tools implementing them or fewer.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.Drive-by Compromise MITRE reference T1189
Top 5%of all ATT&CK techniques for number of groups
31 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
DaggerflyG1034 ↗
Has used strategic website compromise for initial access against victims.1
Mustard TempestG1020 ↗
Has used drive-by downloads for initial infection, often using fake browser updates as a lure.1234
CURIUMG1012 ↗
Has used strategic website compromise to infect victims with malware such as IMAPLoader.1
Earth LuscaG1006 ↗
Has performed watering hole attacks.1
AndarielG0138 ↗
Has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.12
All 31 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus compromised the www.tradingtechnologies[.]com website hosting a hidden IFRAME to exploit visitors, two months before the site was known to deliver a compromised version of the X_TRADER software package.1
C0010C0010 ↗
During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.1
Operation Dust StormC0016 ↗
During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.1
All 3 campaigns for this technique
10 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
SocGholishS1124 ↗
Has been distributed through compromised websites with malicious content often masquerading as browser updates.1
Snip3S1086 ↗
Has been delivered to targets via downloads from malicious domains.1
Bad RabbitS0606 ↗
Spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.12
GrandoreiroS0531 ↗
Has used compromised websites and Google Ads to bait victims into downloading its installer.12
REvilS0496 ↗
Has infected victim machines through compromised websites and exploit kits.1234
IcedIDS0483 ↗
Has cloned legitimate websites/applications to distribute the malware.1
All 10 software entries for this technique · 6 newest in this preview
Offense vs defense T1189
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 3Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 2
first rule: 2017 Q4 · 3 of 3 campaigns plottedDrive-by Compromise detection strategy DET0176
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)
4 platforms
AN0498 · Windows
Correlated evidence of anomalous browser/network behavior (suspicious external resource fetches and script injection patterns) followed by atypical child processes, ephemeral execution contexts, memory modification or process injection, and unexpected file drops. Defender sees network requests to previously unseen/suspicious domains or resources + browser process spawning unusual children or loading unsigned modules + file writes or registry changes shortly after those requests.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | etw:Microsoft-Windows-Kernel-Process | Memory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Application Log ContentDC0038 | WinEventLog:Application | Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation time window between suspicious network fetch and subsequent process/file events. Tweak for environment latency and caching; default 2 minutes. |
| KnownGoodDomainsList | Allowlist of high-volume, benign domains used by corporate sites or CDNs to reduce false positives. |
| PayloadEntropyThreshold | Entropy threshold for downloaded script/binary content to surface likely obfuscated/packed payloads. |
| UserContext | Exclude or treat differently known administrative service accounts or build machines versus end-user contexts. |
AN0499 · Linux
Correlated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections that deviate from baseline. Defender sees: uncommon resource fetch → short-lived child process executions from user browser context → file writes in temp directories → anomalous outbound C2-like connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget) |
| Application Log ContentDC0038 | linux:syslog | Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads |
| File CreationDC0039 | linux:Sysmon | New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch |
| Network Connection CreationDC0082 | NSM:Connections | Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports |
| Network Traffic ContentDC0085 | NSM:Flow | http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TempPathPatterns | Paths used for staging differ by distro and package manager; tune to include company-specific temp paths or exclude known benign build machines. |
| UserShellWhitelist | Whitelist known server/service accounts or CI/CD runners where shell executions are expected. |
| DomainRarityThreshold | Threshold for flagging domains based on internal popularity vs global rarity. |
AN0500 · macOS
Correlated evidence where Safari/Chrome/WebKit-based processes issue network requests for uncommon or obfuscated JS resources followed by spawning of script interpreters, launchd or ad-hoc binaries, unusual child processes, or dynamic library loads into browser processes. Defender sees: proxy/HTTP logs with suspicious resource content + unifiedlogs/ASL showing browser/plugin crashes or extension loads + process events indicating child process creation and file writes to /var/folders or /tmp shortly after the fetch.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | macos:unifiedlog | Anomalous dyld dynamic library loads or RWX memory mappings in browser process |
| Process CreationDC0032 | macos:unifiedlog | process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary |
| Application Log ContentDC0038 | macos:unifiedlog | Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches |
| File CreationDC0039 | macos:unifiedlog | New files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children |
| Network Traffic ContentDC0085 | NSM:Flow | HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SleepyUserThreshold | Volume thresholds for interactive user browsing vs. automated systems (e.g., shared kiosks) — tune to reduce FP in heavy-browsing employees. |
| ExtensionInstallPolicy | Policy setting that influences how extension installs are treated: strict policy reduces FP from known extension behavior. |
AN0501 · Identity Provider
Post-compromise identity & session anomalies that follow a drive-by compromise: token reuse from new/unfamiliar IPs, anomalous sign-in patterns for previously inactive users, unexpected consent/grant events, or provisioning changes. Defender sees an endpoint/browser compromise (network + endpoint signals) followed by unusual IdP events: new refresh token issuance, consent/consent-grant events, odd MFA bypass patterns, or unusual OAuth client registrations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | azure:signinlogs | SignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times |
| User Account MetadataDC0013 | saas:auth | Refresh token issuance or refresh token usage from new IPs or user agents |
| Application Log ContentDC0038 | m365:unified | Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise |
| Logon Session CreationDC0067 | AWS:CloudTrail | ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IdpAlertWindow | Time window to correlate IdP events to endpoint compromise alerts (default 30 minutes to 2 hours). |
| HighRiskCountryList | List of countries/IP zones considered high risk for sign-ins; used to tune geo-anomalies. |
| DeviceTrustLevel | Device trust scoring thresholds that influence whether a sign-in is considered suspicious. |
Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. The risks of additional exploits and weaknesses in implementation may still exist for these types of systems.
Exploit ProtectionM1050
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. Many of these protections depend on the architecture and target application binary for compatibility.
Adblockers can help prevent malicious code served through ads from executing in the first place. Script blocking extensions can also help to prevent the execution of JavaScript. Consider disabling browser push notifications from certain applications and browsers.
Update SoftwareM1051
Ensuring that all browsers and plugins are kept updated can help prevent the exploit phase of this technique. Use modern browsers with security features turned on.
User TrainingM1017
Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.