Techniques › T1102 › T1102.003
T1102.003 One-Way Communication
command and control — Linux, macOS, Windows, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
2
Sigma rules tagged attack.t1102.003
0
KEV CVEs mapped here
<p>Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.</p><p>Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0581 Detect One-Way Web Service Command Channels v1.0
AN1599 WindowsSuspicious process initiating outbound connections to web services without corresponding response or return traffic, indicative of one-way command channels.Tunable:
DestinationDomainTimeWindowProcessNameAN1600 LinuxCurl, wget, or custom HTTP clients initiated by uncommon user accounts or cron jobs to popular web services, with no observed response parsing logic.Tunable:ParentProcessCommandLineArgsAN1601 macOSProcess using URLSession or similar API to fetch from web services without any response handling, indicative of one-way C2 channels.Tunable:UserContextEntropyScoreAN1602 ESXiESXi shell or scheduled tasks initiating outbound HTTPS to known public services without inbound return or loggable response, used to fetch instructions.Tunable:ScheduledTaskNameDestinationIP
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1102.003
Author: Florian Roth (Nextron Systems)
· 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Author: Florian Roth (Nextron Systems)
· 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Rules tagged at the parent level (attack.t1102) 13
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Florian Roth (Nextron Systems)
· 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Sorina Ionescu, X__Junior (Nextron Systems)
· 2022-08-17 (modified 2026-03-29) · logsource: product=windows category=network_connection · 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=windows category=network_connection · 3ab65069-d82a-4d44-a759-466661a082d1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-06-24 (modified 2024-07-16) · logsource: product=windows category=network_connection · 5c80b618-0dbb-46e6-acbb-03d90bcb6d83
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-21) · logsource: product=windows category=process_creation · 7050bba1-1aed-454e-8f73-3f46f09ce56a
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Author: Gavin Knapp
· 2023-05-01 (modified 2025-02-22) · logsource: product=windows category=network_connection · 7e9cf7b6-e827-11ed-a05b-0242ac120003
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)
Author: Gavin Knapp
· 2023-05-03 · logsource: product=windows category=network_connection · 7e9cf7b6-e827-11ed-a05b-15959c120003
Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-20) · logsource: product=windows category=process_creation · 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=linux category=network_connection · c4568f5d-131f-4e78-83d4-45b2da0ec4f1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Florian Roth (Nextron Systems)
· 2023-01-18 (modified 2023-08-29) · logsource: product=windows category=process_creation · cea2b7ea-792b-405f-95a1-b903ea06458f
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service