Winter VivernG1035 ↗
Has used compromised WordPress sites to host malicious payloads for download.1
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.2
- Created
- 01 October 2020
- Last modified
- 24 October 2025
- Contributor
- Dor Edry, Microsoft
Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing.[1] Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Web Services MITRE reference T1584.006
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
CURIUMG1012 ↗
Has compromised legitimate websites to enable strategic website compromise attacks.1
Earth LuscaG1006 ↗
Has compromised Google Drive repositories.1
TurlaG0010 ↗
Has frequently used compromised WordPress sites for C2 infrastructure.1
All 4 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation MidnightEclipseC0048 ↗
During Operation MidnightEclipse, threat actors abused compromised AWS buckets to store files.1
All 1 campaigns for this technique
Offense vs defense T1584.006
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Web Services detection strategy DET0882
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Web Services
1 platform
AN2014 · PRE
Once adversaries leverage the abused web service as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control Web Service or Exfiltration Over Web Service .
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Response ContentDC0104 | Internet Scan | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.