Detect Web Services in Splunk
Adversaries may compromise access to third-party web services to use as infrastructure during cyber operations. Popular platforms such as GitHub, WordPress, Google Drive, Dropbox, Discord, and SendGrid are targeted because they offer high availability, trusted domain reputations, and blend into legitimate organizational traffic. Compromised web service accounts are leveraged for command and control (C2) via dead-drop resolvers, payload hosting, data exfiltration staging, and phishing campaign infrastructure. Real-world examples include Turla using compromised WordPress sites for C2, Earth Lusca abusing Google Drive repositories, Gootloader inserting malicious scripts into CMS installations, and Winter Vivern hosting malicious payloads on compromised WordPress instances. Detection pivots to observable network behavior: suspicious processes making connections to web service API domains, scripting engines or LOLBins fetching content from anonymous paste sites, and non-browser processes accessing WordPress-specific URL paths on external domains.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1584 Compromise Infrastructure
- Sub-technique
- T1584.006 Web Services
- Canonical reference
- https://attack.mitre.org/techniques/T1584/006/
SPL Detection Query
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| eval dest_host=lower(DestinationHostname)
| eval is_web_service=if(match(dest_host, "(github\.com|githubusercontent\.com|pastebin\.com|paste\.ee|pastecode\.io|hastebin\.com|dropbox\.com|dropboxusercontent\.com|googleapis\.com|drive\.google\.com|discord\.com|discordapp\.com|sendgrid\.net|hooks\.slack\.com|notion\.so)"), 1, 0)
| where is_web_service=1
| eval image_lower=lower(Image)
| eval is_suspicious=if(match(image_lower, "(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|msbuild\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)"), 1, 0)
| where is_suspicious=1
| eval proc_category=case(
match(image_lower, "(powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe)"), "scripting_engine",
match(image_lower, "(mshta\.exe|regsvr32\.exe|rundll32\.exe|msbuild\.exe)"), "lolbin",
match(image_lower, "(certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)"), "download_utility",
true(), "other"
)
| eval high_risk_parent=if(match(lower(ParentImage), "(outlook\.exe|winword\.exe|excel\.exe|powerpnt\.exe|onenote\.exe|acrord32\.exe|chrome\.exe|msedge\.exe|firefox\.exe)"), 1, 0)
| eval risk_score=proc_category+"_"+if(high_risk_parent=1, "office_parent", "standard_parent")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DestinationHostname, DestinationIp, DestinationPort, proc_category, high_risk_parent, risk_score
| sort - _timeDetects suspicious processes making outbound network connections to web service domains using Sysmon Event ID 3 (Network Connection). Evaluates the initiating process against known scripting engines, LOLBins, and download utilities, then categorizes the risk by process type and parent process context. high_risk_parent=1 indicates the suspicious process was spawned from an Office application or browser, the highest-fidelity signal for phishing-delivered payloads using compromised web service infrastructure.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Developer workstations where git.exe or IDE tooling invokes curl.exe to call GitHub APIs for routine source control operations
- IT automation and configuration management scripts using curl or PowerShell to download packages from authorized cloud storage
- Backup agents connecting to cloud storage services (Dropbox, Google Drive) from known service account identities
- CI/CD pipeline agents making GitHub API calls via PowerShell or curl as part of automated deployment processes
- Security platforms (SOAR, SIEM connectors, threat intelligence tools) calling external APIs for enrichment or sample submission
Other platforms for T1584.006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Dead-Drop Resolver via GitHub Raw Content
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'raw.githubusercontent.com' and 'DownloadString'. Sysmon Event ID 3: Network Connection from powershell.exe to raw.githubusercontent.com on port 443. Sysmon Event ID 22: DNS query for raw.githubusercontent.com. PowerShell ScriptBlock Log Event ID 4104: full script content including the URL.
- Test 2Certutil LOLBin Download from Pastebin
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache', '-split', '-f', and 'pastebin.com'. Sysmon Event ID 3: Network Connection from certutil.exe to pastebin.com on port 443. Sysmon Event ID 11: File Create event for the output file in %TEMP%.
- Test 3cURL Payload Retrieval from Discord CDN
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'discord.com' and '-o'. Sysmon Event ID 3: Network Connection from curl.exe to discord.com on port 443. Sysmon Event ID 11: File Create event for the output file in %TEMP%.
- Test 4WScript Accessing Compromised Web Service via JScript
Expected signal: Sysmon Event ID 1 (first): Process Create for powershell.exe creating the JS file. Sysmon Event ID 11: File Create for %TEMP%\df00tech_wstest.js. Sysmon Event ID 1 (second): Process Create for wscript.exe executing the JS file. Sysmon Event ID 3: Network Connection from wscript.exe to api.github.com on port 443. Sysmon Event ID 22: DNS query for api.github.com from wscript.exe.
References (7)
- https://attack.mitre.org/techniques/T1584/006/
- https://www.recordedfuture.com/research/turla-apt-infrastructure
- https://www.trendmicro.com/en_us/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques.html
- https://www.sentinelone.com/labs/gootloaders-gone-wild/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc.html
- https://www.sentinelone.com/labs/winter-vivern-all-summer-long/
- https://threatconnect.com/blog/infrastructure-research-hunting/
Unlock Pro Content
Get the full detection package for T1584.006 including response playbook, investigation guide, and atomic red team tests.