Which SIEM platforms have a T1102.003 detection rule?

df00tech provides T1102.003 (One-Way Communication) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect One-Way Communication (T1102.003)?

Detecting One-Way Communication requires the following data sources: Network Traffic: Network Connection Creation, Process: Process Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1102.003 detection?

The T1102.003 detection is rated medium severity with medium confidence.

What are common false positives for T1102.003?

Common false positives for T1102.003 include: Developers and DevOps engineers using git clients, GitHub CLI, or GitLab runners on workstations that legitimately connect to GitHub or GitLab; IT automation tools (Ansible, Puppet, Chef) polling GitHub for configuration or playbook updates; Software update mechanisms that fetch release notes, changelogs, or update manifests from GitHub or Google APIs.

T1102.003 IBM QRadar · QRadar

Detect One-Way Communication in IBM QRadar

Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media (GitHub, Twitter/X, Telegram, GitLab, TechNet) to host command and control (C2) instructions. Those infected systems may send output back over a different C2 channel or return no output at all. Using common services makes it easier for adversaries to hide in expected noise, and SSL/TLS encryption from Web service providers adds an additional layer of protection.

MITRE ATT&CK

Tactic: Command and Control
Technique: T1102 Web Service
Sub-technique: T1102.003 One-Way Communication
Canonical reference: https://attack.mitre.org/techniques/T1102/003/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  username,
  QIDNAME(qid) AS event_name,
  LOGSOURCENAME(logsourceid) AS log_source,
  "Image" AS process_image,
  "CommandLine" AS command_line,
  "ParentImage" AS parent_image,
  "ParentCommandLine" AS parent_command_line,
  "DestinationHostname" AS dest_hostname,
  "DestinationPort" AS dest_port
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) LIKE '%Sysmon%'
  AND QIDNAME(qid) LIKE '%Network connection%'
  AND (
    LOWER("DestinationHostname") LIKE '%twitter.com%' OR
    LOWER("DestinationHostname") LIKE '%x.com%' OR
    LOWER("DestinationHostname") LIKE '%github.com%' OR
    LOWER("DestinationHostname") LIKE '%githubusercontent.com%' OR
    LOWER("DestinationHostname") LIKE '%gitlab.com%' OR
    LOWER("DestinationHostname") LIKE '%telegram.org%' OR
    LOWER("DestinationHostname") LIKE '%t.me%' OR
    LOWER("DestinationHostname") LIKE '%pastebin.com%' OR
    LOWER("DestinationHostname") LIKE '%paste.ee%' OR
    LOWER("DestinationHostname") LIKE '%hastebin.com%' OR
    LOWER("DestinationHostname") LIKE '%discord.com%' OR
    LOWER("DestinationHostname") LIKE '%discordapp.com%' OR
    LOWER("DestinationHostname") LIKE '%googleapis.com%' OR
    LOWER("DestinationHostname") LIKE '%sharepoint.com%' OR
    LOWER("DestinationHostname") LIKE '%reddit.com%' OR
    LOWER("DestinationHostname") LIKE '%notion.so%' OR
    LOWER("DestinationHostname") LIKE '%trello.com%'
  )
  AND (
    LOWER("Image") LIKE '%powershell.exe' OR
    LOWER("Image") LIKE '%pwsh.exe' OR
    LOWER("Image") LIKE '%cmd.exe' OR
    LOWER("Image") LIKE '%wscript.exe' OR
    LOWER("Image") LIKE '%cscript.exe' OR
    LOWER("Image") LIKE '%mshta.exe' OR
    LOWER("Image") LIKE '%rundll32.exe' OR
    LOWER("Image") LIKE '%regsvr32.exe' OR
    LOWER("Image") LIKE '%certutil.exe' OR
    LOWER("Image") LIKE '%curl.exe' OR
    LOWER("Image") LIKE '%wget.exe' OR
    LOWER("Image") LIKE '%bitsadmin.exe' OR
    LOWER("Image") LIKE '%python.exe' OR
    LOWER("Image") LIKE '%python3.exe' OR
    LOWER("Image") LIKE '%node.exe' OR
    LOWER("Image") LIKE '%wmic.exe' OR
    LOWER("Image") LIKE '%msbuild.exe'
  )
  AND starttime > NOW - 86400000
ORDER BY starttime DESC

high severity medium confidence

QRadar AQL query targeting Sysmon EventCode 3 (Network Connection) events where LOLBins or interpreter runtimes initiate outbound connections to legitimate web platforms abused for one-way C2 (T1102.003). Correlates initiating process image against a list of high-risk executables and destination hostname against known command-delivery platforms including GitHub, Telegram, Pastebin, Discord, and cloud storage services.

Data Sources

IBM QRadar SIEMMicrosoft Sysmon DSM (Windows)Windows Security Event Log DSM

Required Tables

events

False Positives & Tuning

Authorized software deployment pipelines that use bitsadmin.exe or msiexec.exe to retrieve installer packages from SharePoint Online or OneDrive corporate file shares
Penetration testing engagements or red team exercises where known C2-over-web-service techniques are being tested against authorized lab endpoints sharing the same log source
IT helpdesk automation runbooks executing PowerShell to poll GitHub repositories or Notion pages for runbook configuration at scheduled intervals

Download portable Sigma rule (.yml)

Other platforms for T1102.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1PowerShell C2 Polling via Pastebin Raw URL
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest', 'pastebin.com/raw', 'Invoke-Expression', '-WindowStyle Hidden'. Sysmon Event ID 3: Network Connection to pastebin.com on port 443. Sysmon Event ID 22: DNS query for pastebin.com. PowerShell ScriptBlock Log Event ID 4104 with the full script content.
Test 2Python Script Polling GitHub Raw Content for Commands
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'raw.githubusercontent.com' and urllib. Sysmon Event ID 3: Three successive network connections to raw.githubusercontent.com on port 443, approximately 30 seconds apart. Sysmon Event ID 22: DNS queries for raw.githubusercontent.com.
Test 3Curl Silent Polling of Telegram Bot API
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing '-s', '-o', 'api.telegram.org', 'getUpdates'. Sysmon Event ID 3: Network Connection to api.telegram.org on port 443. Sysmon Event ID 11: File creation at %TEMP%\tg_response.txt. Sysmon Event ID 22: DNS query for api.telegram.org.
Test 4Scheduled Task Simulating Periodic Web Service C2 Poll
Expected signal: Security Event ID 4698 (Scheduled Task Created) with task name 'MicrosoftEdgeUpdateTaskMachineUA_ARGUSTEST' and command containing 'raw.githubusercontent.com'. Sysmon Event ID 1: schtasks.exe process creation. Registry event for new task in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache. On execution: Sysmon Event ID 1 for powershell.exe spawned by taskeng.exe/taskhostw.exe, Sysmon Event ID 3 for network connection to raw.githubusercontent.com.

Last updated: 2026-04-17 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1102.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect One-Way Communication in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1102.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1102.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

Get new detections in your inbox