Detect Dead Drop Resolver in Microsoft Sentinel
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries post content (dead drop resolvers) on services like Pastebin, GitHub, Twitter, Google Docs, YouTube, or Microsoft TechNet with embedded and often obfuscated or encoded domains or IP addresses. Infected victims reach out to these resolvers to obtain real C2 server addresses, allowing attackers to change infrastructure dynamically while hiding behind trusted domains. This technique leverages the legitimacy and SSL/TLS encryption of popular web services to blend into normal network traffic and protect back-end C2 infrastructure from discovery through malware binary analysis.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1102 Web Service
- Sub-technique
- T1102.001 Dead Drop Resolver
- Canonical reference
- https://attack.mitre.org/techniques/T1102/001/
KQL Detection Query
let DeadDropDomains = dynamic([
"pastebin.com", "pastebin.pl", "paste.ee", "hastebin.com",
"github.com", "raw.githubusercontent.com", "gist.github.com",
"twitter.com", "api.twitter.com", "t.co",
"docs.google.com", "drive.google.com", "sites.google.com",
"youtube.com", "youtu.be",
"technet.microsoft.com", "social.technet.microsoft.com",
"livejournal.com",
"imgur.com", "i.imgur.com",
"reddit.com", "old.reddit.com",
"cloudflare.com", "workers.dev",
"amazonaws.com", "s3.amazonaws.com",
"onedrive.live.com", "sharepoint.com",
"notion.so", "trello.com",
"discord.com", "discordapp.com",
"telegram.org", "t.me"
]);
let SuspiciousProcesses = dynamic([
"powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
"curl.exe", "wget.exe", "bitsadmin.exe"
]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (DeadDropDomains)
| where InitiatingProcessFileName in~ (SuspiciousProcesses)
or (InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "opera.exe", "brave.exe", "safari.exe", "outlook.exe", "teams.exe", "slack.exe", "onedrive.exe", "dropbox.exe", "svchost.exe"))
| extend IsKnownBrowser = InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "opera.exe", "brave.exe")
| extend IsSuspiciousProcess = InitiatingProcessFileName in~ (SuspiciousProcesses)
| extend PastebinAccess = RemoteUrl has_any ("pastebin.com", "pastebin.pl", "paste.ee", "hastebin.com")
| extend GitHubRawAccess = RemoteUrl has_any ("raw.githubusercontent.com", "gist.github.com")
| extend SocialMediaAccess = RemoteUrl has_any ("twitter.com", "api.twitter.com", "reddit.com")
| extend CloudStorageAccess = RemoteUrl has_any ("amazonaws.com", "onedrive.live.com", "sharepoint.com", "docs.google.com", "drive.google.com")
| project Timestamp, DeviceName, AccountName,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName,
RemoteUrl, RemoteIP, RemotePort, RemoteIPType,
IsKnownBrowser, IsSuspiciousProcess,
PastebinAccess, GitHubRawAccess, SocialMediaAccess, CloudStorageAccess
| sort by Timestamp descDetects network connections to commonly abused web services (Pastebin, GitHub, Twitter, Google Docs, etc.) initiated by suspicious non-browser processes. Dead drop resolvers rely on these legitimate services to host encoded C2 addresses. The query identifies connections from scripting engines, shells, and LOLBins to known dead drop hosting platforms. Browser-initiated traffic is separated from non-browser process connections to reduce false positive volume while flagging high-fidelity hits from scripting interpreters.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate developer tooling (git clients, CI/CD agents, IDEs) making programmatic requests to GitHub APIs or raw content URLs
- Software update mechanisms or package managers (npm, pip, Chocolatey) resolving dependencies from GitHub or cloud storage
- IT automation scripts (Ansible, Chef, Puppet, Terraform) using PowerShell or cmd.exe to fetch configuration data from cloud services like S3 or SharePoint
- Security monitoring agents or vulnerability scanners that fetch IOC feeds or configuration from Pastebin-like services
- Corporate applications that legitimately integrate with Google Drive, SharePoint, or OneDrive using background service processes
Other platforms for T1102.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Dead Drop Resolver — Pastebin C2 Address Retrieval
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-WindowStyle Hidden' and 'Net.WebClient' and 'pastebin.com'. Sysmon Event ID 3: Network connection from powershell.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com from the powershell.exe process. Sysmon Event ID 11: File creation event for ddr_test_output.txt in %TEMP%.
- Test 2cURL Dead Drop Resolver — GitHub Raw Content Fetch
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'raw.githubusercontent.com' and '-o' flag. Sysmon Event ID 3: Network connection from curl.exe to raw.githubusercontent.com port 443. Sysmon Event ID 22: DNS query for raw.githubusercontent.com. Sysmon Event ID 11: File creation event for ddr_github_test.txt in %TEMP%.
- Test 3WScript Dead Drop Resolver — VBScript Fetching Content from Legitimate Service
Expected signal: Sysmon Event ID 1: Process Create with Image=wscript.exe, CommandLine referencing pastebin.com URL. Sysmon Event ID 3: Network connection from wscript.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com from wscript.exe process. File creation in C:\Windows\Temp\.
- Test 4Certutil Dead Drop — Fetching Encoded Content from Web Service
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache' and 'pastebin.com'. Sysmon Event ID 3: Network connection from certutil.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com. Sysmon Event ID 11: File creation of ddr_certutil_test.txt. Windows Security Event ID 4688 (if command line auditing enabled).
References (11)
- https://attack.mitre.org/techniques/T1102/001/
- https://www.welivesecurity.com/2019/10/03/who-is-monsieur-fancy-bear/
- https://securelist.com/the-banking-trojans-in-brazil-july-2020/97372/
- https://www.mandiant.com/resources/apt41-dual-espionage-and-cyber-crime-operation
- https://www.fireeye.com/blog/threat-research/2014/09/darwin-s-favorite-apt-group-2.html
- https://www.paloaltonetworks.com/blog/2017/06/unit42-paranoid-plugx/
- https://research.checkpoint.com/2022/apt35-exploits-log4shell-campaign/
- https://www.zscaler.com/blogs/security-research/kimsuky-translatext-chrome-extension
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-network-events
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1102.001/T1102.001.md
Unlock Pro Content
Get the full detection package for T1102.001 including response playbook, investigation guide, and atomic red team tests.