Detect Web Services in Elastic Security
Adversaries may compromise access to third-party web services to use as infrastructure during cyber operations. Popular platforms such as GitHub, WordPress, Google Drive, Dropbox, Discord, and SendGrid are targeted because they offer high availability, trusted domain reputations, and blend into legitimate organizational traffic. Compromised web service accounts are leveraged for command and control (C2) via dead-drop resolvers, payload hosting, data exfiltration staging, and phishing campaign infrastructure. Real-world examples include Turla using compromised WordPress sites for C2, Earth Lusca abusing Google Drive repositories, Gootloader inserting malicious scripts into CMS installations, and Winter Vivern hosting malicious payloads on compromised WordPress instances. Detection pivots to observable network behavior: suspicious processes making connections to web service API domains, scripting engines or LOLBins fetching content from anonymous paste sites, and non-browser processes accessing WordPress-specific URL paths on external domains.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1584 Compromise Infrastructure
- Sub-technique
- T1584.006 Web Services
- Canonical reference
- https://attack.mitre.org/techniques/T1584/006/
Elastic Detection Query
network where event.type == "connection_attempted"
and network.direction == "outbound"
and destination.port in (80, 443, 8080, 8443)
and not destination.ip : ("10.*", "172.16.*", "172.17.*", "172.18.*", "172.19.*", "172.20.*", "172.21.*", "172.22.*", "172.23.*", "172.24.*", "172.25.*", "172.26.*", "172.27.*", "172.28.*", "172.29.*", "172.30.*", "172.31.*", "192.168.*", "127.*")
and process.name : ("nslookup.exe", "powershell.exe", "cmd.exe", "python.exe", "python3")Elastic EQL detection for Web Services. Detects suspicious processes making outbound network connections to web service domains commonly abused for C2 payload hosting, dead-drop resolvers, and exfiltration staging. Monitors scripting engine
Data Sources
Required Tables
False Positives & Tuning
- Legitimate outbound connections to cloud hosting providers for business services
- Security research teams connecting to VPS infrastructure for authorized testing
- IT teams managing company-owned VPS or cloud instances
- Developer connections to cloud-based development environments
Other platforms for T1584.006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Dead-Drop Resolver via GitHub Raw Content
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'raw.githubusercontent.com' and 'DownloadString'. Sysmon Event ID 3: Network Connection from powershell.exe to raw.githubusercontent.com on port 443. Sysmon Event ID 22: DNS query for raw.githubusercontent.com. PowerShell ScriptBlock Log Event ID 4104: full script content including the URL.
- Test 2Certutil LOLBin Download from Pastebin
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache', '-split', '-f', and 'pastebin.com'. Sysmon Event ID 3: Network Connection from certutil.exe to pastebin.com on port 443. Sysmon Event ID 11: File Create event for the output file in %TEMP%.
- Test 3cURL Payload Retrieval from Discord CDN
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'discord.com' and '-o'. Sysmon Event ID 3: Network Connection from curl.exe to discord.com on port 443. Sysmon Event ID 11: File Create event for the output file in %TEMP%.
- Test 4WScript Accessing Compromised Web Service via JScript
Expected signal: Sysmon Event ID 1 (first): Process Create for powershell.exe creating the JS file. Sysmon Event ID 11: File Create for %TEMP%\df00tech_wstest.js. Sysmon Event ID 1 (second): Process Create for wscript.exe executing the JS file. Sysmon Event ID 3: Network Connection from wscript.exe to api.github.com on port 443. Sysmon Event ID 22: DNS query for api.github.com from wscript.exe.
References (7)
- https://attack.mitre.org/techniques/T1584/006/
- https://www.recordedfuture.com/research/turla-apt-infrastructure
- https://www.trendmicro.com/en_us/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques.html
- https://www.sentinelone.com/labs/gootloaders-gone-wild/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc.html
- https://www.sentinelone.com/labs/winter-vivern-all-summer-long/
- https://threatconnect.com/blog/infrastructure-research-hunting/
Unlock Pro Content
Get the full detection package for T1584.006 including response playbook, investigation guide, and atomic red team tests.