Applied Cybernetics Group
T1583.006 Web Services
- Technique
T1583.006- Tactics
- Resource Development
- Research, 90 days
- 5
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 0
- Elastic, Splunk
- 2
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1583/006
MITRE description
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29)(Citation: Hacker News GitHub Abuse 2024) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-21Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge -
2026-10-15Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering -
2026-09-29Microsoft Threat Intelligence: Phishing Abuses RMM Tools for Persistent Access -
2026-08-27Recorded Future Insikt: BlueDelta Targets Defense and Diplomacy with HOOKEDGE -
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
Elastic and Splunk rules
- GitHub Repo Created (elastic)
- Cisco Secure Firewall - Rare Snort Rule Triggered (splunk)