T1102 · Web Service

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1102 · Web Service · Sunturai

attack-patternenterprise-attackT1102

Web Service

attack-pattern--830c9528-df21-472c-8c14-a036bf17d665

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Created: May 31, 2017, 9:31 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

3 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

56 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows Ngrok Reverse Proxy Usage	Informational	Splunk security content	Oct 10, 2026	Apache License 2.0
Connection to Common Large Language Model Endpoints	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Network Connection to OAST Domain via Script Interpreter	High	Elastic detection rules	Sep 26, 2026	Elastic License 2.0
Connection to Commonly Abused Web Services	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Web Request	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Network Connection to Suspicious Web Service	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Curl to Google App Script Endpoint	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Etherhiding C2 via Blockchain Connection	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Google Calendar C2 via Script Interpreter	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential EtherHiding C2 via Curl JSON-RPC Request	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious AWS S3 Connection via Script Interpreter	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Linux Telegram API Request	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual DNS Request to Suspicious Top Level Domain	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS CLI Command with Custom Endpoint URL	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Statistical Model Detected C2 Beaconing Activity with High Confidence	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Statistical Model Detected C2 Beaconing Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS SNS Topic Message Publish by Rare User	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS SNS Rare Protocol Subscription by User	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Uncommon DNS Request via Bun or Node.js	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious File Downloaded from Google Drive	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Cisco Cloud Security - Hack Tool User-Agent Detected	Medium	—	Sep 4, 2026	MIT License
A host is potentially running a hacking tool (ASIM Web Session schema)	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Request for single resource on domain	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Discord download invoked from cmd line	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Detect requests for an uncommon resources on the web (ASIM Web Session)	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 25 of 56

Filter in the catalogue

External references

mitre-attackT1102Open reference

Broadcom BirdyClient Microsoft Graph API 2024Open reference

University of Birmingham C2Open reference

Platforms

ESXiLinuxmacOSWindows

Kill chain phases

command-and-control

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object