T1102Command and Control
Web Service
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
13 Sigma rules tagged T1102Web ServiceT110213 general rules
- Communication To LocaltoNet Tunneling Service Initiatedhightest
- Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest
- Communication To Ngrok Tunneling Service - Linuxhightest
- Communication To Ngrok Tunneling Service Initiatedhightest
- New Connection Initiated To Potential Dead Drop Resolver Domainhightest
- Process Initiated Network Connection To Ngrok Domainhightest
- Suspicious Child Process Of Manage Engine ServiceDeskhightest
- Cloudflared Tunnel Connections Cleanupmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Web Service
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.