T1102 Web Service

Technique

T1102

Tactics

Command and Control

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

13

Elastic, Splunk

24

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1102

MITRE description

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-09-29 Microsoft Threat Intelligence: Phishing Abuses RMM Tools for Persistent Access
• 2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

• Communication To LocaltoNet Tunneling Service Initiated - Linux (core)
• Communication To Ngrok Tunneling Service - Linux (core)
• Network Connection Initiated To AzureWebsites.NET By Non-Browser Process (core)
• New Connection Initiated To Potential Dead Drop Resolver Domain (core)
• Suspicious Non-Browser Network Communication With Google API (core)
• Communication To LocaltoNet Tunneling Service Initiated (core)
• Communication To Ngrok Tunneling Service Initiated (core)
• Process Initiated Network Connection To Ngrok Domain (core)
• Potentially Suspicious Network Connection To Notion API (core)
• Suspicious Non-Browser Network Communication With Telegram API (core)
• Cloudflared Tunnel Connections Cleanup (core)
• Cloudflared Tunnel Execution (core)
• Suspicious Child Process Of Manage Engine ServiceDesk (core)

Elastic and Splunk rules

• Connection to Common Large Language Model Endpoints (elastic)
• Suspicious File Downloaded from Google Drive (elastic)
• Network Connection to OAST Domain via Script Interpreter (elastic)
• Uncommon DNS Request via Bun or Node.js (elastic)
• AWS SNS Rare Protocol Subscription by User (elastic)
• AWS SNS Topic Message Publish by Rare User (elastic)
• Statistical Model Detected C2 Beaconing Activity (elastic)
• Statistical Model Detected C2 Beaconing Activity with High Confidence (elastic)
• AWS CLI Command with Custom Endpoint URL (elastic)
• Unusual DNS Request to Suspicious Top Level Domain (elastic)
• Linux Telegram API Request (elastic)
• Suspicious AWS S3 Connection via Script Interpreter (elastic)
• Potential EtherHiding C2 via Curl JSON-RPC Request (elastic)
• Google Calendar C2 via Script Interpreter (elastic)
• Potential Etherhiding C2 via Blockchain Connection (elastic)
• Suspicious Curl to Google App Script Endpoint (elastic)
• Unusual Network Connection to Suspicious Web Service (elastic)
• Unusual Web Request (elastic)
• Connection to Commonly Abused Web Services (elastic)
• DNS to Commonly Abused Web Services (elastic)
• Linux Ngrok Reverse Proxy Usage (splunk)
• Windows Ngrok Reverse Proxy Usage (splunk)
• Ngrok Reverse Proxy on Network (splunk)
• Windows Abused Web Services (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.