Techniques › T1102.002 › AN0102
AN0102 Analytic 0102
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Scripting engines (e.g., osascript, Python) initiating HTTPS requests to social media or content-sharing platforms, paired with automated response handling indicative of two-way communication.</p>
- Detects
- T1102.002 Bidirectional Communication
- Part of
- DET0035 Detect Bidirectional Web Service C2 Channels via Process & Network Correlation
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | log stream --info --predicate 'subsystem == "com.apple.cfprefsd"' | DC0032 Process Creation |
| NSM:Connections | web domain alerts | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ScriptEngineList | Scripting interpreters to monitor for unusual HTTP traffic (e.g., osascript, ruby, bash) |
SocialMediaDomainPatterns | Patterns or domains used for C2 dead drops and responses (e.g., pastebin.com, twitter.com) |
BurstConnectionRate | Threshold for number of short-lived HTTPS connections in a short window |