Detect Web Services in Sumo Logic CSE
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services such as those offered by Google, GitHub, Discord, Telegram, or Dropbox makes it easier for adversaries to hide in expected noise. Real-world threat actors including APT29, Turla, Earth Lusca, Mustang Panda, Lazarus Group, HAFNIUM, MuddyWater, and Contagious Interview have all leveraged legitimate web platforms to host malware, stage C2 infrastructure, or receive exfiltrated data. Because the adversary's actual registration of these accounts occurs entirely outside the victim environment, detection pivots to identifying the operational use of these platforms by suspicious processes within monitored endpoints.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1583 Acquire Infrastructure
- Sub-technique
- T1583.006 Web Services
- Canonical reference
- https://attack.mitre.org/techniques/T1583/006/
Sumo Detection Query
_sourceCategory=*sysmon* OR _sourceCategory=*windows*
| where EventID = "3"
| parse regex "(?i)Image:\\s*(?P<process_name>[^\r\n]+)" nodrop
| parse regex "(?i)CommandLine:\\s*(?P<command_line>[^\r\n]+)" nodrop
| parse regex "(?i)ParentImage:\\s*(?P<parent_image>[^\r\n]+)" nodrop
| parse regex "(?i)ParentCommandLine:\\s*(?P<parent_command_line>[^\r\n]+)" nodrop
| parse regex "(?i)DestinationHostname:\\s*(?P<dest_hostname>[^\r\n]+)" nodrop
| parse regex "(?i)DestinationIp:\\s*(?P<dest_ip>[^\r\n]+)" nodrop
| parse regex "(?i)DestinationPort:\\s*(?P<dest_port>[^\r\n]+)" nodrop
| parse regex "(?i)User:\\s*(?P<username>[^\r\n]+)" nodrop
| where process_name matches /(?i)(powershell\.exe|pwsh\.exe|cmd\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|python\.exe|pythonw\.exe|python3\.exe|java\.exe|javaw\.exe|msbuild\.exe|installutil\.exe|csc\.exe)/
| where dest_hostname matches /(?i)(api\.github\.com|raw\.githubusercontent\.com|gist\.githubusercontent\.com|gist\.github\.com|api\.dropboxapi\.com|content\.dropboxapi\.com|www\.dropbox\.com|www\.googleapis\.com|drive\.google\.com|storage\.googleapis\.com|firebaseio\.com|firebase\.google\.com|api\.telegram\.org|discord\.com|discordapp\.com|cdn\.discordapp\.com|hooks\.discord\.com|pastebin\.com|rentry\.co|paste\.ee|hastebin\.com|trycloudflare\.com|workers\.dev|notion\.so|api\.notion\.com|graph\.microsoft\.com|onedrive\.live\.com|terabox\.com|sync\.com|filemail\.com|file\.io)/
| if(dest_hostname matches /(?i)(raw\.githubusercontent\.com|gist\.githubusercontent\.com|pastebin\.com|rentry\.co|paste\.ee|hastebin\.com)/, 1, 0) as IsPayloadRetrieve
| if(dest_hostname matches /(?i)(api\.telegram\.org|discord\.com|discordapp\.com|firebaseio\.com|trycloudflare\.com|workers\.dev)/, 1, 0) as IsC2Channel
| if(dest_hostname matches /(?i)(api\.dropboxapi\.com|content\.dropboxapi\.com|drive\.google\.com|storage\.googleapis\.com|terabox\.com|filemail\.com|onedrive\.live\.com)/, 1, 0) as IsDataExfil
| (IsPayloadRetrieve + IsC2Channel + IsDataExfil) as SuspicionScore
| fields _messageTime, _sourceHost, username, process_name, command_line, parent_image, parent_command_line, dest_hostname, dest_ip, dest_port, IsPayloadRetrieve, IsC2Channel, IsDataExfil, SuspicionScore
| sort by _messageTime descParses raw Sysmon Event ID 3 (Network Connection) XML log lines ingested into Sumo Logic, extracting process, parent, destination, and user context fields before applying LOLBin and web-service-domain filters. Categorical scoring fields (IsPayloadRetrieve, IsC2Channel, IsDataExfil) replicate the analyst triage logic from the reference SPL query, enabling rapid prioritisation within the Sumo Logic UI or Cloud SIEM Enterprise rules.
Data Sources
Required Tables
False Positives & Tuning
- CI/CD build agents running MSBuild, csc.exe, or Python that resolve GitHub, Google Cloud Storage, or Dropbox hostnames as part of package retrieval and artifact publishing during sanctioned pipelines
- Productivity applications (e.g., VS Code, Jupyter) that launch cmd.exe or wscript.exe as child processes to sync notebooks or projects to OneDrive, Notion, or Google Drive
- Corporate IT scripts using bitsadmin.exe or certutil.exe to retrieve approved software packages from filemail.com or sync.com distribution endpoints managed by the organisation's software team
Other platforms for T1583.006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Payload Retrieval from GitHub Raw Content
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Net.WebClient' and 'raw.githubusercontent.com'. Sysmon Event ID 3: Network Connection to raw.githubusercontent.com:443. Sysmon Event ID 22: DNS Query for raw.githubusercontent.com from powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with the full script. DeviceNetworkEvents in MDE will show RemoteUrl matching raw.githubusercontent.com.
- Test 2Data Exfiltration Simulation to Dropbox API via curl
Expected signal: Sysmon Event ID 3: Network Connection from curl.exe to content.dropboxapi.com:443. Sysmon Event ID 22: DNS Query for content.dropboxapi.com from curl.exe. Sysmon Event ID 11: File Create for the temp file. DeviceNetworkEvents in MDE will show InitiatingProcessFileName=curl.exe, RemoteUrl matching content.dropboxapi.com. The HTTP response will be 401, but the connection event is logged regardless.
- Test 3Telegram Bot API C2 Polling Simulation
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'api.telegram.org' and 'getUpdates'. Sysmon Event ID 3: Network Connection from powershell.exe to api.telegram.org:443. Sysmon Event ID 22: DNS Query for api.telegram.org from powershell.exe. PowerShell ScriptBlock Log Event ID 4104 capturing the Invoke-RestMethod call. DeviceNetworkEvents in MDE shows RemoteUrl matching api.telegram.org.
- Test 4Multi-Stage Web Service Abuse — Payload Retrieval Then C2 Check-In
Expected signal: Sysmon Event ID 1: Single powershell.exe process with long command line containing both pastebin.com and discord.com references. Sysmon Event ID 3: Two network connection events — one to pastebin.com:443, one to discord.com:443. Sysmon Event ID 22: Two DNS queries — pastebin.com and discord.com — both initiated by powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with the full script. DeviceNetworkEvents in MDE shows two entries with RemoteUrl matching pastebin.com and discord.com respectively.
References (10)
- https://attack.mitre.org/techniques/T1583/006/
- https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf
- https://thehackernews.com/expert-insights/2024/05/github-abuse-flaw-shows-why-we-cant.html
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf
- https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
- https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign
- https://threatconnect.com/blog/infrastructure-research-hunting/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1102/T1102.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
Unlock Pro Content
Get the full detection package for T1583.006 including response playbook, investigation guide, and atomic red team tests.