{"id":"T1189","name":"Drive-by Compromise","url":"https://attack.mitre.org/techniques/T1189","tactics":["initial-access"],"platforms":["Identity Provider","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0176","stix_id":"x-mitre-detection-strategy--a070f9d2-3480-4362-99b3-8b36f5be0189","name":"Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)","url":"https://attack.mitre.org/detectionstrategies/DET0176","analytics":[{"id":"AN0498","stix_id":"x-mitre-analytic--35701083-a327-4f68-a426-13751b9743c3","name":"Analytic 0498","description":"Correlated evidence of anomalous browser/network behavior (suspicious external resource fetches and script injection patterns) followed by atypical child processes, ephemeral execution contexts, memory modification or process injection, and unexpected file drops. Defender sees network requests to previously unseen/suspicious domains or resources + browser process spawning unusual children or loading unsigned modules + file writes or registry changes shortly after those requests.","url":"https://attack.mitre.org/detectionstrategies/DET0176#AN0498","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Application","channel":"Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-application"},{"name":"etw:Microsoft-Windows-Kernel-Process","channel":"Memory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"etw-microsoft-windows-kernel-process"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation time window between suspicious network fetch and subsequent process/file events. Tweak for environment latency and caching; default 2 minutes."},{"field":"KnownGoodDomainsList","description":"Allowlist of high-volume, benign domains used by corporate sites or CDNs to reduce false positives."},{"field":"PayloadEntropyThreshold","description":"Entropy threshold for downloaded script/binary content to surface likely obfuscated/packed payloads."},{"field":"UserContext","description":"Exclude or treat differently known administrative service accounts or build machines versus end-user contexts."}],"live":true,"detection_strategies":["DET0176"],"techniques":["T1189"]},{"id":"AN0499","stix_id":"x-mitre-analytic--32b5b330-2a40-4117-8999-395c23490614","name":"Analytic 0499","description":"Correlated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections that deviate from baseline. Defender sees: uncommon resource fetch → short-lived child process executions from user browser context → file writes in temp directories → anomalous outbound C2-like connections.","url":"https://attack.mitre.org/detectionstrategies/DET0176#AN0499","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget)","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"linux:Sysmon","channel":"New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"linux-sysmon"},{"name":"NSM:Connections","channel":"Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-connections"}],"mutable_elements":[{"field":"TempPathPatterns","description":"Paths used for staging differ by distro and package manager; tune to include company-specific temp paths or exclude known benign build machines."},{"field":"UserShellWhitelist","description":"Whitelist known server/service accounts or CI/CD runners where shell executions are expected."},{"field":"DomainRarityThreshold","description":"Threshold for flagging domains based on internal popularity vs global rarity."}],"live":true,"detection_strategies":["DET0176"],"techniques":["T1189"]},{"id":"AN0500","stix_id":"x-mitre-analytic--230a55ce-4584-4588-a006-5532a9efdbd8","name":"Analytic 0500","description":"Correlated evidence where Safari/Chrome/WebKit-based processes issue network requests for uncommon or obfuscated JS resources followed by spawning of script interpreters, launchd or ad-hoc binaries, unusual child processes, or dynamic library loads into browser processes. Defender sees: proxy/HTTP logs with suspicious resource content + unifiedlogs/ASL showing browser/plugin crashes or extension loads + process events indicating child process creation and file writes to /var/folders or /tmp shortly after the fetch.","url":"https://attack.mitre.org/detectionstrategies/DET0176#AN0500","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"New files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects)","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"},{"name":"macos:unifiedlog","channel":"Anomalous dyld dynamic library loads or RWX memory mappings in browser process","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"SleepyUserThreshold","description":"Volume thresholds for interactive user browsing vs. automated systems (e.g., shared kiosks) — tune to reduce FP in heavy-browsing employees."},{"field":"ExtensionInstallPolicy","description":"Policy setting that influences how extension installs are treated: strict policy reduces FP from known extension behavior."}],"live":true,"detection_strategies":["DET0176"],"techniques":["T1189"]},{"id":"AN0501","stix_id":"x-mitre-analytic--3154acf3-a5df-40bd-b4bc-3a210b6e5e0e","name":"Analytic 0501","description":"Post-compromise identity & session anomalies that follow a drive-by compromise: token reuse from new/unfamiliar IPs, anomalous sign-in patterns for previously inactive users, unexpected consent/grant events, or provisioning changes. Defender sees an endpoint/browser compromise (network + endpoint signals) followed by unusual IdP events: new refresh token issuance, consent/consent-grant events, odd MFA bypass patterns, or unusual OAuth client registrations.","url":"https://attack.mitre.org/detectionstrategies/DET0176#AN0501","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"SignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"azure-signinlogs"},{"name":"m365:unified","channel":"Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"},{"name":"saas:auth","channel":"Refresh token issuance or refresh token usage from new IPs or user agents","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"saas-auth"},{"name":"AWS:CloudTrail","channel":"ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"IdpAlertWindow","description":"Time window to correlate IdP events to endpoint compromise alerts (default 30 minutes to 2 hours)."},{"field":"HighRiskCountryList","description":"List of countries/IP zones considered high risk for sign-ins; used to tune geo-anomalies."},{"field":"DeviceTrustLevel","description":"Device trust scoring thresholds that influence whether a sign-in is considered suspicious."}],"live":true,"detection_strategies":["DET0176"],"techniques":["T1189"]}],"live":true,"version":"1.0","techniques":["T1189"]}],"sigma_rules":[{"id":"0250638a-2b28-4541-86fc-ea4c558fa0c6","title":"Suspicious Browser Child Process - MacOS","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-04-05","modified":null,"description":"Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.","references":["https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1189","attack.t1203","attack.t1059"],"path":"rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml","techniques":["T1189","T1203","T1059"],"cves":[]},{"id":"4922a5dd-6743-4fc2-8e81-144374280997","title":"Flash Player Update from Suspicious Location","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-10-25","modified":"2022-08-08","description":"Detects a flashplayer update from an unofficial location","references":["https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb"],"logsource":{"category":"proxy"},"tags":["attack.initial-access","attack.stealth","attack.t1189","attack.execution","attack.t1204.002","attack.t1036.005"],"path":"rules/web/proxy_generic/proxy_susp_flash_download_loc.yml","techniques":["T1189","T1204.002","T1036.005"],"cves":[]},{"id":"65354b83-a2ea-4ea6-8414-3ab38be0d409","title":"Cross Site Scripting Strings","author":"Saw Win Naung, Nasreddine Bencherchali","status":"test","level":"high","date":"2021-08-15","modified":"2022-06-14","description":"Detects XSS attempts injected via GET requests in access logs","references":["https://github.com/payloadbox/xss-payload-list","https://portswigger.net/web-security/cross-site-scripting/contexts"],"logsource":{"category":"webserver"},"tags":["attack.initial-access","attack.t1189"],"path":"rules/web/webserver_generic/web_xss_in_access_logs.yml","techniques":["T1189"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-6558","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-6554","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-5419","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-24201","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-38112","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-5274","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4947","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-4671","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-43770","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-7024","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2012-5054","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2010-1297","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2015-0310","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2015-8651","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2014-8439","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2015-0313","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2012-2034","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2016-7855","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2016-1019","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2015-3043","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2010-0188","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}