Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Web Service

Sub-techniques (3)

ID	Name
.001	Dead Drop Resolver
.002	Bidirectional Communication
.003	One-Way Communication

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

ID: T1102

Sub-techniques: .001 .002 .003

Tactic(s): Command and Control

Platforms: Linux, macOS, Windows

Permissions Required: User

Data Sources: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Version: 1.1

Created: 31 May 2017

Last Modified: 26 Mar 2020

Name	Description
Procedure Examples
Inception	Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Symantec Inception Framework March 2018)
Carbon	Carbon can use Pastebin to receive C2 commands.(Citation: Accenture HyperStack October 2020)
Rocke	Rocke has used Pastebin, Gitee, and GitLab for Command and Control.(Citation: Anomali Rocke March 2019)(Citation: Talos Rocke August 2018)
Chimera	Chimera has used Google Cloud's appspot service to host C2 servers.(Citation: Cycraft Chimera April 2020)
BoomBox	BoomBox can download files from Dropbox using a hardcoded access token.(Citation: MSTIC Nobelium Toolset May 2021)
SharpStage	SharpStage has used a legitimate web service for evading detection.(Citation: Cybereason Molerats Dec 2020)
	During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.(Citation: ESET Operation Spalax Jan 2021)
FIN6	FIN6 has used Pastebin and Google Storage to host content for their operations.(Citation: FireEye FIN6 Apr 2019)
SMOKEDHAM	SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.(Citation: FireEye Shining A Light on DARKSIDE May 2021)
LazyScripter	LazyScripter has used GitHub to host its payloads to operate spam campaigns.(Citation: MalwareBytes LazyScripter Feb 2021)
DropBook	DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
Bumblebee	Bumblebee has been downloaded to victim's machines from OneDrive.(Citation: Proofpoint Bumblebee April 2022)
FIN8	FIN8 has used `sslip.io`, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.(Citation: Bitdefender FIN8 July 2021)
Hildegard	Hildegard has downloaded scripts from GitHub.(Citation: Unit 42 Hildegard Malware)
EXOTIC LILY	EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.(Citation: Google EXOTIC LILY March 2022)
Sibot	Sibot has used a legitimate compromised website to download DLLs to the victim's machine.(Citation: MSTIC NOBELIUM Mar 2021)
Ember Bear	Ember Bear has used Discord's content delivery network (CDN) to deliver malware and malicious scripts to a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
NETWIRE	NETWIRE has used web services including Paste.ee to host payloads.(Citation: FireEye NETWIRE March 2019)
CharmPower	CharmPower can download additional modules from actor-controlled Amazon S3 buckets.(Citation: Check Point APT35 CharmPower January 2022)
WhisperGate	WhisperGate can download additional payloads hosted on a Discord channel.(Citation: Crowdstrike WhisperGate January 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Microsoft WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)
Doki	Doki has used the dogechain.info API to generate a C2 address.(Citation: Intezer Doki July 20)
GuLoader	GuLoader has the ability to download malware from Google Drive.(Citation: Medium Eli Salem GuLoader April 2021)
Fox Kitten	Fox Kitten has used Amazon Web Services to host C2.(Citation: ClearSky Pay2Kitten December 2020)
Bazar	Bazar downloads have been hosted on Google Docs.(Citation: Cybereason Bazar July 2020)(Citation: Zscaler Bazar September 2020)
Turla	Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.(Citation: Accenture HyperStack October 2020)(Citation: ESET Crutch December 2020)
Mustang Panda	Mustang Panda has used DropBox URLs to deliver variants of PlugX.(Citation: Proofpoint TA416 Europe March 2022)
Gamaredon Group	Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.(Citation: ESET Gamaredon June 2020)
Ngrok	Ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.(Citation: Zdnet Ngrok September 2018)
APT32	APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.(Citation: Volexity Ocean Lotus November 2020)
TeamTNT	TeamTNT has leveraged iplogger.org to send collected data back to C2.(Citation: Aqua TeamTNT August 2020)(Citation: Cisco Talos Intelligence Group)

Mitigation	Description
Mitigations
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
Web Service Mitigation	Firewalls and Web proxies can be used to enforce external network communication policy. It may be difficult for an organization to block particular services because so many of them are commonly used during the course of business. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol or encoded commands used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)
Restrict Web-Based Content	Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.

Detection

Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.