Detect Dead Drop Resolver in Splunk
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries post content (dead drop resolvers) on services like Pastebin, GitHub, Twitter, Google Docs, YouTube, or Microsoft TechNet with embedded and often obfuscated or encoded domains or IP addresses. Infected victims reach out to these resolvers to obtain real C2 server addresses, allowing attackers to change infrastructure dynamically while hiding behind trusted domains. This technique leverages the legitimacy and SSL/TLS encryption of popular web services to blend into normal network traffic and protect back-end C2 infrastructure from discovery through malware binary analysis.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1102 Web Service
- Sub-technique
- T1102.001 Dead Drop Resolver
- Canonical reference
- https://attack.mitre.org/techniques/T1102/001/
SPL Detection Query
index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3)
OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22)
| eval TargetHost=coalesce(DestinationHostname, QueryName)
| eval InitiatingProcess=lower(coalesce(Image, ""))
| where match(TargetHost, "(pastebin\.com|pastebin\.pl|paste\.ee|hastebin\.com|raw\.githubusercontent\.com|gist\.github\.com|api\.twitter\.com|docs\.google\.com|drive\.google\.com|youtube\.com|livejournal\.com|imgur\.com|reddit\.com|workers\.dev|amazonaws\.com|notion\.so|discord\.com|t\.me|technet\.microsoft\.com)")
| eval IsSuspiciousProcess=if(match(InitiatingProcess, "(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|curl\.exe|wget\.exe|bitsadmin\.exe|python\.exe|python3\.exe|perl\.exe|ruby\.exe|java\.exe|msiexec\.exe)"), 1, 0)
| eval IsKnownBrowser=if(match(InitiatingProcess, "(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe|safari\.exe)"), 1, 0)
| eval IsPastebin=if(match(TargetHost, "(pastebin\.com|pastebin\.pl|paste\.ee|hastebin\.com)"), 1, 0)
| eval IsGitHubRaw=if(match(TargetHost, "(raw\.githubusercontent\.com|gist\.github\.com)"), 1, 0)
| eval IsSocialMedia=if(match(TargetHost, "(api\.twitter\.com|reddit\.com|livejournal\.com)"), 1, 0)
| eval IsCloudStorage=if(match(TargetHost, "(amazonaws\.com|docs\.google\.com|drive\.google\.com|onedrive\.live\.com|sharepoint\.com)"), 1, 0)
| eval RiskScore=IsSuspiciousProcess + IsPastebin + IsGitHubRaw + IsSocialMedia + IsCloudStorage
| where IsSuspiciousProcess=1 OR (IsKnownBrowser=0 AND RiskScore > 0)
| table _time, host, User, InitiatingProcess, ParentImage, CommandLine, ParentCommandLine, TargetHost, DestinationIp, DestinationPort, IsSuspiciousProcess, IsKnownBrowser, IsPastebin, IsGitHubRaw, IsSocialMedia, IsCloudStorage, RiskScore
| sort - _timeDetects Sysmon network connections (Event ID 3) and DNS queries (Event ID 22) to known dead drop resolver hosting platforms, initiated by suspicious non-browser processes. Assigns a risk score based on the combination of suspicious initiating process and targeted domain category. High-risk combinations (scripting engines connecting to Pastebin, raw GitHub content, or social media APIs) are prioritized for analyst review. Separates browser traffic from non-browser traffic to reduce noise.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate developer tooling (git clients, CI/CD agents, IDEs) making programmatic requests to GitHub APIs or raw content URLs
- Software update mechanisms or package managers (npm, pip, Chocolatey) resolving dependencies from GitHub or cloud storage
- IT automation scripts using PowerShell or scripting languages to fetch configuration data from cloud services
- Security monitoring agents fetching threat intelligence or IOC feeds from paste sites
- Developer workstations running scripts that interact with GitHub, AWS S3, or Google APIs as part of normal workflow
Other platforms for T1102.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Dead Drop Resolver — Pastebin C2 Address Retrieval
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-WindowStyle Hidden' and 'Net.WebClient' and 'pastebin.com'. Sysmon Event ID 3: Network connection from powershell.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com from the powershell.exe process. Sysmon Event ID 11: File creation event for ddr_test_output.txt in %TEMP%.
- Test 2cURL Dead Drop Resolver — GitHub Raw Content Fetch
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'raw.githubusercontent.com' and '-o' flag. Sysmon Event ID 3: Network connection from curl.exe to raw.githubusercontent.com port 443. Sysmon Event ID 22: DNS query for raw.githubusercontent.com. Sysmon Event ID 11: File creation event for ddr_github_test.txt in %TEMP%.
- Test 3WScript Dead Drop Resolver — VBScript Fetching Content from Legitimate Service
Expected signal: Sysmon Event ID 1: Process Create with Image=wscript.exe, CommandLine referencing pastebin.com URL. Sysmon Event ID 3: Network connection from wscript.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com from wscript.exe process. File creation in C:\Windows\Temp\.
- Test 4Certutil Dead Drop — Fetching Encoded Content from Web Service
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache' and 'pastebin.com'. Sysmon Event ID 3: Network connection from certutil.exe to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com. Sysmon Event ID 11: File creation of ddr_certutil_test.txt. Windows Security Event ID 4688 (if command line auditing enabled).
References (11)
- https://attack.mitre.org/techniques/T1102/001/
- https://www.welivesecurity.com/2019/10/03/who-is-monsieur-fancy-bear/
- https://securelist.com/the-banking-trojans-in-brazil-july-2020/97372/
- https://www.mandiant.com/resources/apt41-dual-espionage-and-cyber-crime-operation
- https://www.fireeye.com/blog/threat-research/2014/09/darwin-s-favorite-apt-group-2.html
- https://www.paloaltonetworks.com/blog/2017/06/unit42-paranoid-plugx/
- https://research.checkpoint.com/2022/apt35-exploits-log4shell-campaign/
- https://www.zscaler.com/blogs/security-research/kimsuky-translatext-chrome-extension
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-network-events
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1102.001/T1102.001.md
Unlock Pro Content
Get the full detection package for T1102.001 including response playbook, investigation guide, and atomic red team tests.