Detect Dead Drop Resolver in Elastic Security
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries post content (dead drop resolvers) on services like Pastebin, GitHub, Twitter, Google Docs, YouTube, or Microsoft TechNet with embedded and often obfuscated or encoded domains or IP addresses. Infected victims reach out to these resolvers to obtain real C2 server addresses, allowing attackers to change infrastructure dynamically while hiding behind trusted domains. This technique leverages the legitimacy and SSL/TLS encryption of popular web services to blend into normal network traffic and protect back-end C2 infrastructure from discovery through malware binary analysis.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1102 Web Service
- Sub-technique
- T1102.001 Dead Drop Resolver
- Canonical reference
- https://attack.mitre.org/techniques/T1102/001/
Elastic Detection Query
sequence by host.id, process.entity_id with maxspan=30s
[network where event.type == "connection" and
network.direction == "egress" and
(
destination.domain : ("pastebin.com", "pastebin.pl", "paste.ee", "hastebin.com",
"raw.githubusercontent.com", "gist.github.com",
"api.twitter.com", "t.co",
"docs.google.com", "drive.google.com", "sites.google.com",
"youtube.com", "youtu.be",
"technet.microsoft.com", "social.technet.microsoft.com",
"livejournal.com", "imgur.com", "i.imgur.com",
"reddit.com", "old.reddit.com",
"workers.dev", "amazonaws.com", "s3.amazonaws.com",
"onedrive.live.com", "sharepoint.com",
"notion.so", "trello.com",
"discord.com", "discordapp.com",
"telegram.org", "t.me")
) and
not process.name : ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe",
"opera.exe", "brave.exe", "safari.exe", "outlook.exe",
"teams.exe", "slack.exe", "onedrive.exe", "dropbox.exe", "svchost.exe") and
(
process.name : ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
"curl.exe", "wget.exe", "bitsadmin.exe", "python.exe",
"python3.exe", "perl.exe", "ruby.exe", "java.exe", "msiexec.exe")
or not process.name : ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe",
"opera.exe", "brave.exe", "safari.exe")
)
]Detects network connections to known dead drop resolver domains initiated by suspicious or non-browser processes. Uses EQL sequence to correlate network events with process context, flagging LOLBins and scripting engines reaching out to paste sites, GitHub raw content, social media APIs, and cloud storage services commonly abused as C2 dead drop resolvers.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate automation scripts or CI/CD pipelines fetching configuration from GitHub raw content or Pastebin during deployment
- Developer tools (e.g., npm, pip, cargo) resolving package metadata or configuration hosted on cloud platforms
- Security tooling or EDR agents performing threat intelligence lookups against paste sites or GitHub-hosted IOC lists
Other platforms for T1102.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Dead Drop Resolver — Pastebin C2 Address Retrieval
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-WindowStyle Hidden' and 'Net.WebClient' and 'pastebin.com'. Sysmon Event ID 3: Network connection from powershell.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com from the powershell.exe process. Sysmon Event ID 11: File creation event for ddr_test_output.txt in %TEMP%.
- Test 2cURL Dead Drop Resolver — GitHub Raw Content Fetch
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'raw.githubusercontent.com' and '-o' flag. Sysmon Event ID 3: Network connection from curl.exe to raw.githubusercontent.com port 443. Sysmon Event ID 22: DNS query for raw.githubusercontent.com. Sysmon Event ID 11: File creation event for ddr_github_test.txt in %TEMP%.
- Test 3WScript Dead Drop Resolver — VBScript Fetching Content from Legitimate Service
Expected signal: Sysmon Event ID 1: Process Create with Image=wscript.exe, CommandLine referencing pastebin.com URL. Sysmon Event ID 3: Network connection from wscript.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com from wscript.exe process. File creation in C:\Windows\Temp\.
- Test 4Certutil Dead Drop — Fetching Encoded Content from Web Service
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache' and 'pastebin.com'. Sysmon Event ID 3: Network connection from certutil.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com. Sysmon Event ID 11: File creation of ddr_certutil_test.txt. Windows Security Event ID 4688 (if command line auditing enabled).
References (11)
- https://attack.mitre.org/techniques/T1102/001/
- https://www.welivesecurity.com/2019/10/03/who-is-monsieur-fancy-bear/
- https://securelist.com/the-banking-trojans-in-brazil-july-2020/97372/
- https://www.mandiant.com/resources/apt41-dual-espionage-and-cyber-crime-operation
- https://www.fireeye.com/blog/threat-research/2014/09/darwin-s-favorite-apt-group-2.html
- https://www.paloaltonetworks.com/blog/2017/06/unit42-paranoid-plugx/
- https://research.checkpoint.com/2022/apt35-exploits-log4shell-campaign/
- https://www.zscaler.com/blogs/security-research/kimsuky-translatext-chrome-extension
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-network-events
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1102.001/T1102.001.md
Unlock Pro Content
Get the full detection package for T1102.001 including response playbook, investigation guide, and atomic red team tests.