Techniques › T1189 › AN0499
AN0499 Analytic 0499
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Correlated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections that deviate from baseline. Defender sees: uncommon resource fetch → short-lived child process executions from user browser context → file writes in temp directories → anomalous outbound C2-like connections.</p>
- Detects
- T1189 Drive-by Compromise
- Part of
- DET0176 Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget) | DC0032 Process Creation |
| linux:syslog | Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads | DC0038 Application Log Content |
| NSM:Flow | http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains | DC0085 Network Traffic Content |
| linux:Sysmon | New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch | DC0039 File Creation |
| NSM:Connections | Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TempPathPatterns | Paths used for staging differ by distro and package manager; tune to include company-specific temp paths or exclude known benign build machines. |
UserShellWhitelist | Whitelist known server/service accounts or CI/CD runners where shell executions are expected. |
DomainRarityThreshold | Threshold for flagging domains based on internal popularity vs global rarity. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2010-0188 | Adobe Reader and Acrobat | Mapped |
| CVE-2010-1297 | Adobe Flash Player | Mapped |
| CVE-2012-2034 | Adobe Flash Player | Mapped |
| CVE-2012-5054 | Adobe Flash Player | Mapped |
| CVE-2014-8439 | Adobe Flash Player | Mapped |
| CVE-2015-0310 | Adobe Flash Player | Mapped |
| CVE-2015-0313 | Adobe Flash Player | Mapped |
| CVE-2015-3043 | Adobe Flash Player | Mapped |
| CVE-2015-8651 | Adobe Flash Player | Mapped |
| CVE-2016-1019 | Adobe Flash Player | Mapped |
| CVE-2016-7855 | Adobe Flash Player | Mapped |
| CVE-2023-43770 | Roundcube Webmail | Mapped |
| CVE-2023-7024 | Google Chromium WebRTC | Mapped |
| CVE-2024-38112 | Microsoft Windows | Mapped |
| CVE-2024-4671 | Google Chromium | Mapped |
| CVE-2024-4947 | Google Chromium V8 | Mapped |
| CVE-2024-5274 | Google Chromium V8 | Mapped |
| CVE-2025-24201 | Apple Multiple Products | Mapped |
| CVE-2025-5419 | Google Chromium V8 | Mapped |
| CVE-2025-6554 | Google Chromium V8 | Mapped |
| CVE-2025-6558 | Google Chromium | Mapped |