Detect Web Services in Sumo Logic CSE
Adversaries may compromise access to third-party web services to use as infrastructure during cyber operations. Popular platforms such as GitHub, WordPress, Google Drive, Dropbox, Discord, and SendGrid are targeted because they offer high availability, trusted domain reputations, and blend into legitimate organizational traffic. Compromised web service accounts are leveraged for command and control (C2) via dead-drop resolvers, payload hosting, data exfiltration staging, and phishing campaign infrastructure. Real-world examples include Turla using compromised WordPress sites for C2, Earth Lusca abusing Google Drive repositories, Gootloader inserting malicious scripts into CMS installations, and Winter Vivern hosting malicious payloads on compromised WordPress instances. Detection pivots to observable network behavior: suspicious processes making connections to web service API domains, scripting engines or LOLBins fetching content from anonymous paste sites, and non-browser processes accessing WordPress-specific URL paths on external domains.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1584 Compromise Infrastructure
- Sub-technique
- T1584.006 Web Services
- Canonical reference
- https://attack.mitre.org/techniques/T1584/006/
Sumo Detection Query
_sourceCategory=*sysmon* OR _sourceCategory=*dns*
| json auto
| where EventCode = 3 or _sourceCategory matches "*dns*"
| where !matches(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)")
| eval ProcessName = lower(Image)
| where !matches(ProcessName, "chrome|firefox|msedge|outlook|teams")
| eval IsDNSRecon = if(matches(ProcessName, "nslookup|dig|host|dnsrecon"), "true", "false")
| eval RiskScore = if(IsDNSRecon = "true", 70,
if(DestinationPort in ("443","8443","4443"), 60, 40))
| where RiskScore >= 60
| stats count AS ConnCount, values(DestinationIp) AS DestIPs, values(ProcessName) AS Processes by _sourceHost, User, DestinationPort
| sort by ConnCount descSumo Logic detection for Web Services. Detects suspicious processes making outbound network connections to web service domains commonly abused for C2 payload hosting, dead-drop resolvers, and exfiltration staging. Monitors scripting engine
Data Sources
Required Tables
False Positives & Tuning
- Legitimate business connections to cloud hosting and CDN providers
- Authorized security testing against self-owned VPS infrastructure
- Developer connections to cloud-based development or CI/CD environments
- IT management connections to company-owned remote servers
Other platforms for T1584.006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Dead-Drop Resolver via GitHub Raw Content
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'raw.githubusercontent.com' and 'DownloadString'. Sysmon Event ID 3: Network Connection from powershell.exe to raw.githubusercontent.com on port 443. Sysmon Event ID 22: DNS query for raw.githubusercontent.com. PowerShell ScriptBlock Log Event ID 4104: full script content including the URL.
- Test 2Certutil LOLBin Download from Pastebin
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache', '-split', '-f', and 'pastebin.com'. Sysmon Event ID 3: Network Connection from certutil.exe to pastebin.com on port 443. Sysmon Event ID 11: File Create event for the output file in %TEMP%.
- Test 3cURL Payload Retrieval from Discord CDN
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'discord.com' and '-o'. Sysmon Event ID 3: Network Connection from curl.exe to discord.com on port 443. Sysmon Event ID 11: File Create event for the output file in %TEMP%.
- Test 4WScript Accessing Compromised Web Service via JScript
Expected signal: Sysmon Event ID 1 (first): Process Create for powershell.exe creating the JS file. Sysmon Event ID 11: File Create for %TEMP%\df00tech_wstest.js. Sysmon Event ID 1 (second): Process Create for wscript.exe executing the JS file. Sysmon Event ID 3: Network Connection from wscript.exe to api.github.com on port 443. Sysmon Event ID 22: DNS query for api.github.com from wscript.exe.
References (7)
- https://attack.mitre.org/techniques/T1584/006/
- https://www.recordedfuture.com/research/turla-apt-infrastructure
- https://www.trendmicro.com/en_us/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques.html
- https://www.sentinelone.com/labs/gootloaders-gone-wild/
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc.html
- https://www.sentinelone.com/labs/winter-vivern-all-summer-long/
- https://threatconnect.com/blog/infrastructure-research-hunting/
Unlock Pro Content
Get the full detection package for T1584.006 including response playbook, investigation guide, and atomic red team tests.