T1102 - Web Service
Tattiche:
Command and Control
Command and Control
Piattaforme:
ESXi Linux Windows macOS
ESXi Linux Windows macOS
Rilevamento:
Not specified
Not specified
Description:
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).
Usato da Attori (14)
Malware (20)
Bumblebee other
SharpStage other
NETWIRE other
BADHATCH other
DropBook other
ShrinkLocker other
Hildegard other
Snip3 other
GuLoader other
WhisperGate other
Raspberry Robin other
Doki other
Nightdoor other
CHIMNEYSWEEP other
SocGholish other
DarkTortilla other
Latrodectus other
CharmPower other
SMOKEDHAM other
RedLine Stealer other
Metadata
| MITRE ID: | T1102 |
| STIX ID: | attack-pattern--830c9528-df21-... |
| Piattaforme: | ESXi, Linux, Windows, macOS |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 16:00 |