kevmap

Techniques › T1102 › T1102.001

T1102.001 Dead Drop Resolver

command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
4
analytics
4
Sigma rules tagged attack.t1102.001
0
KEV CVEs mapped here
<p>Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.</p><p>Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.</p><p>Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1102.001

New Connection Initiated To Potential Dead Drop Resolver Domain hightest
Author: Sorina Ionescu, X__Junior (Nextron Systems) · 2022-08-17 (modified 2026-03-29) · logsource: product=windows category=network_connection · 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
Techniques: T1102T1102.001
PwnDrp Access criticaltest
Author: Florian Roth (Nextron Systems) · 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Techniques: T1071.001T1102.001T1102.003
Raw Paste Service Access hightest
Author: Florian Roth (Nextron Systems) · 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Techniques: T1071.001T1102.001T1102.003
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2024-06-24 (modified 2024-07-16) · logsource: product=windows category=network_connection · 5c80b618-0dbb-46e6-acbb-03d90bcb6d83
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Techniques: T1102T1102.001

Rules tagged at the parent level (attack.t1102) 13

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Process Initiated Network Connection To Ngrok Domain hightest
Author: Florian Roth (Nextron Systems) · 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670
Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Techniques: T1567T1572T1102
Communication To Ngrok Tunneling Service - Linux hightest
Author: Florian Roth (Nextron Systems) · 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Techniques: T1567T1568.002T1572T1090T1102
Communication To Ngrok Tunneling Service Initiated hightest
Author: Florian Roth (Nextron Systems) · 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Techniques: T1567T1568.002T1572T1090T1102
New Connection Initiated To Potential Dead Drop Resolver Domain hightest
Author: Sorina Ionescu, X__Junior (Nextron Systems) · 2022-08-17 (modified 2026-03-29) · logsource: product=windows category=network_connection · 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
Techniques: T1102T1102.001
Communication To LocaltoNet Tunneling Service Initiated hightest
Author: Andreas Braathen (mnemonic.io) · 2024-06-17 · logsource: product=windows category=network_connection · 3ab65069-d82a-4d44-a759-466661a082d1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Techniques: T1572T1090T1102
Network Connection Initiated To AzureWebsites.NET By Non-Browser Process mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2024-06-24 (modified 2024-07-16) · logsource: product=windows category=network_connection · 5c80b618-0dbb-46e6-acbb-03d90bcb6d83
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Techniques: T1102T1102.001
Cloudflared Tunnel Connections Cleanup mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-17 (modified 2023-12-21) · logsource: product=windows category=process_creation · 7050bba1-1aed-454e-8f73-3f46f09ce56a
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Techniques: T1102T1090T1572
Suspicious Non-Browser Network Communication With Google API mediumexperimental
Author: Gavin Knapp · 2023-05-01 (modified 2025-02-22) · logsource: product=windows category=network_connection · 7e9cf7b6-e827-11ed-a05b-0242ac120003
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)
Techniques: T1102
Potentially Suspicious Network Connection To Notion API lowtest
Author: Gavin Knapp · 2023-05-03 · logsource: product=windows category=network_connection · 7e9cf7b6-e827-11ed-a05b-15959c120003
Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"
Techniques: T1102
Cloudflared Tunnel Execution mediumtest
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) · 2023-05-17 (modified 2023-12-20) · logsource: product=windows category=process_creation · 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Techniques: T1102T1090T1572
Suspicious Non-Browser Network Communication With Telegram API mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Techniques: T1102T1567T1105
Communication To LocaltoNet Tunneling Service Initiated - Linux hightest
Author: Andreas Braathen (mnemonic.io) · 2024-06-17 · logsource: product=linux category=network_connection · c4568f5d-131f-4e78-83d4-45b2da0ec4f1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Techniques: T1572T1090T1102
Suspicious Child Process Of Manage Engine ServiceDesk hightest
Author: Florian Roth (Nextron Systems) · 2023-01-18 (modified 2023-08-29) · logsource: product=windows category=process_creation · cea2b7ea-792b-405f-95a1-b903ea06458f
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Techniques: T1102