Web Services

Web Services [T1583.006]

Information

Name: Web Services
ID: T1583.006
Tactics:
Technique:

Introduction

The MITRE ATT&CK sub-technique Web Services [T1583.006] refers to adversaries leveraging legitimate web-based services and infrastructure to host, distribute, or control malicious payloads and communication channels. Attackers exploit trusted third-party platforms or self-hosted web services to blend malicious traffic with legitimate web traffic, thereby reducing suspicion and evading detection mechanisms.

Deep Dive Into Technique

Attackers frequently exploit legitimate web services and cloud-based platforms to host malicious payloads, scripts, or command-and-control (C2) infrastructure. This sub-technique involves the following detailed execution methods and mechanisms:

Hosting Malicious Payloads:
- Attackers upload malware, scripts, or exploit kits to legitimate cloud storage services (e.g., Amazon S3, Google Cloud Storage, Azure Blob Storage).
- Malicious payloads are then delivered to victim systems via trusted URLs, bypassing reputation-based security filters.
Command-and-Control (C2) Infrastructure:
- Adversaries utilize web-based APIs and webhooks provided by legitimate services (e.g., GitHub, Slack, Discord, Pastebin) to communicate with compromised systems.
- Malicious communications blend seamlessly into legitimate web traffic, making detection challenging.
Data Exfiltration via Web Services:
- Attackers leverage legitimate cloud storage APIs or web services to exfiltrate sensitive data.
- Data exfiltration occurs using HTTPS requests, making inspection and detection difficult without proper SSL/TLS inspection.
Domain Fronting and CDN Abuse:
- Attackers exploit Content Delivery Networks (CDNs) and domain fronting techniques to hide the true destination of malicious traffic.
- Traffic appears directed at legitimate domains, masking the attacker's actual infrastructure.
Web Shells Hosted on Legitimate Web Servers:
- Attackers compromise legitimate web servers and deploy web shells to maintain persistence and remote control.
- Web shells provide attackers with a persistent, covert entry point to victim networks.

When this Technique is Usually Used

Attackers use the Web Services sub-technique across multiple attack scenarios and stages, including:

Initial Access and Delivery:
- Delivering malware payloads hosted on trusted web services to bypass email and web filtering controls.
- Distributing malicious documents, scripts, or executables via trusted cloud storage links.
Command-and-Control (C2):
- Establishing covert communication channels through legitimate web-based APIs and services.
- Using benign-looking HTTP/HTTPS requests to trusted web services to control compromised hosts.
Persistence and Lateral Movement:
- Deploying web shells or malicious scripts on compromised web servers for persistent access.
- Using legitimate web services to host scripts or payloads used in lateral movement within victim networks.
Exfiltration:
- Transferring stolen data to attacker-controlled cloud storage or web services using legitimate APIs.
- Utilizing trusted web services to mask exfiltration traffic and evade detection.

How this Technique is Usually Detected

Detection of the Web Services sub-technique involves multiple approaches and tools:

Network Traffic Analysis and Monitoring:
- Inspecting outbound HTTPS traffic with SSL/TLS interception and deep packet inspection.
- Identifying unusual or high-volume traffic to legitimate cloud storage or web service domains.
Behavioral Analytics and Anomaly Detection:
- Monitoring API usage patterns and detecting abnormal spikes or unusual API access patterns.
- Detecting access to known legitimate services from unusual geographical locations or at unusual times.
Endpoint Detection and Response (EDR):
- Monitoring endpoint processes accessing known legitimate web services for suspicious activities.
- Detecting unusual scripts or binaries communicating with cloud services or APIs.
Web Server Monitoring and Log Analysis:
- Analyzing web server logs for indicators of web shell deployment (e.g., unusual file uploads, unexpected PHP or ASP.NET scripts).
- Monitoring for suspicious POST requests or HTTP responses indicative of web shell activity.
Specific IoCs (Indicators of Compromise):
- Suspicious URLs or API endpoints associated with known attacker-controlled cloud storage buckets or repositories.
- Known malicious web shell filenames, hashes, or signatures.
- Unusual HTTP headers, user-agent strings, or request patterns indicative of malicious activity.

Why it is Important to Detect This Technique

Early detection of the Web Services sub-technique is critical due to its significant impacts on systems and networks:

Stealth and Evasion:
- Attackers leverage legitimate, trusted web services, making malicious traffic difficult to distinguish from legitimate traffic.
- Delayed detection increases dwell time, enabling attackers to establish persistence, escalate privileges, and exfiltrate sensitive data.
Data Exfiltration Risks:
- Attackers can exfiltrate sensitive data via trusted web services, resulting in significant data breaches and compliance violations.
- Early detection prevents unauthorized data transfer and reduces potential damage.
Persistence and Long-Term Compromise:
- Web shells and malicious scripts hosted on legitimate web servers provide attackers with persistent access, enabling long-term compromise.
- Detecting and removing web shells early prevents attackers from establishing a foothold within the network.
Reputation and Compliance Implications:
- Failure to detect malicious use of legitimate web services can lead to regulatory fines, legal consequences, and reputational damage.
- Early detection and remediation minimize these risks and demonstrate proactive security posture.

Examples

Real-world examples illustrate how attackers have leveraged the Web Services sub-technique:

APT29 (Cozy Bear) SolarWinds Attack:
- Attackers used legitimate cloud infrastructure and web services (e.g., AWS, Azure) to host malicious payloads and conduct C2 communications.
- Malicious traffic blended seamlessly into legitimate cloud service traffic, significantly complicating detection and response efforts.
FIN7 Campaigns:
- FIN7 leveraged legitimate cloud storage services (such as Google Drive or Dropbox) to host malicious documents and payloads.
- Victims received phishing emails containing trusted URLs, bypassing email security gateways and endpoint protection.
Magecart Web Skimming Attacks:
- Attackers injected malicious JavaScript into legitimate e-commerce websites, leveraging compromised web servers to host skimming scripts.
- Malicious scripts exfiltrated payment card data to attacker-controlled cloud services or domains, evading detection for extended periods.
Use of GitHub and Pastebin for C2 (Multiple Threat Actors):
- Attackers frequently use GitHub repositories or Pastebin pastes to host C2 instructions or payloads.
- Compromised systems regularly poll these legitimate services for commands, making detection challenging without behavioral analysis.
Cobalt Strike Beacon Hosted on Cloud Infrastructure:
- Attackers deploy Cobalt Strike payloads hosted on legitimate cloud infrastructure (e.g., Amazon S3 buckets, Azure blobs).
- Victims download and execute payloads from trusted URLs, bypassing traditional security controls and endpoint detection.

These examples underscore the diverse methods attackers use to exploit legitimate web services, highlighting the need for robust detection and response capabilities.

Last updated 1 month ago

Introduction

Deep Dive Into Technique

Hosting Malicious Payloads:

Attackers upload malware, scripts, or exploit kits to legitimate cloud storage services (e.g., Amazon S3, Google Cloud Storage, Azure Blob Storage).
Malicious payloads are then delivered to victim systems via trusted URLs, bypassing reputation-based security filters.

Command-and-Control (C2) Infrastructure:

Adversaries utilize web-based APIs and webhooks provided by legitimate services (e.g., GitHub, Slack, Discord, Pastebin) to communicate with compromised systems.
Malicious communications blend seamlessly into legitimate web traffic, making detection challenging.

Data Exfiltration via Web Services:

Attackers leverage legitimate cloud storage APIs or web services to exfiltrate sensitive data.
Data exfiltration occurs using HTTPS requests, making inspection and detection difficult without proper SSL/TLS inspection.

Domain Fronting and CDN Abuse:

Attackers exploit Content Delivery Networks (CDNs) and domain fronting techniques to hide the true destination of malicious traffic.
Traffic appears directed at legitimate domains, masking the attacker's actual infrastructure.

Web Shells Hosted on Legitimate Web Servers:

Attackers compromise legitimate web servers and deploy web shells to maintain persistence and remote control.
Web shells provide attackers with a persistent, covert entry point to victim networks.

When this Technique is Usually Used

Attackers use the Web Services sub-technique across multiple attack scenarios and stages, including:

Initial Access and Delivery:

Delivering malware payloads hosted on trusted web services to bypass email and web filtering controls.
Distributing malicious documents, scripts, or executables via trusted cloud storage links.

Command-and-Control (C2):

Establishing covert communication channels through legitimate web-based APIs and services.
Using benign-looking HTTP/HTTPS requests to trusted web services to control compromised hosts.

Persistence and Lateral Movement:

Deploying web shells or malicious scripts on compromised web servers for persistent access.
Using legitimate web services to host scripts or payloads used in lateral movement within victim networks.

Exfiltration:

Transferring stolen data to attacker-controlled cloud storage or web services using legitimate APIs.
Utilizing trusted web services to mask exfiltration traffic and evade detection.

How this Technique is Usually Detected

Detection of the Web Services sub-technique involves multiple approaches and tools:

Network Traffic Analysis and Monitoring:

Inspecting outbound HTTPS traffic with SSL/TLS interception and deep packet inspection.
Identifying unusual or high-volume traffic to legitimate cloud storage or web service domains.

Behavioral Analytics and Anomaly Detection:

Monitoring API usage patterns and detecting abnormal spikes or unusual API access patterns.
Detecting access to known legitimate services from unusual geographical locations or at unusual times.

Endpoint Detection and Response (EDR):

Monitoring endpoint processes accessing known legitimate web services for suspicious activities.
Detecting unusual scripts or binaries communicating with cloud services or APIs.

Web Server Monitoring and Log Analysis:

Analyzing web server logs for indicators of web shell deployment (e.g., unusual file uploads, unexpected PHP or ASP.NET scripts).
Monitoring for suspicious POST requests or HTTP responses indicative of web shell activity.

Specific IoCs (Indicators of Compromise):

Suspicious URLs or API endpoints associated with known attacker-controlled cloud storage buckets or repositories.
Known malicious web shell filenames, hashes, or signatures.
Unusual HTTP headers, user-agent strings, or request patterns indicative of malicious activity.

Why it is Important to Detect This Technique

Early detection of the Web Services sub-technique is critical due to its significant impacts on systems and networks:

Stealth and Evasion:

Attackers leverage legitimate, trusted web services, making malicious traffic difficult to distinguish from legitimate traffic.
Delayed detection increases dwell time, enabling attackers to establish persistence, escalate privileges, and exfiltrate sensitive data.

Data Exfiltration Risks:

Attackers can exfiltrate sensitive data via trusted web services, resulting in significant data breaches and compliance violations.
Early detection prevents unauthorized data transfer and reduces potential damage.

Persistence and Long-Term Compromise:

Web shells and malicious scripts hosted on legitimate web servers provide attackers with persistent access, enabling long-term compromise.
Detecting and removing web shells early prevents attackers from establishing a foothold within the network.

Reputation and Compliance Implications:

Failure to detect malicious use of legitimate web services can lead to regulatory fines, legal consequences, and reputational damage.
Early detection and remediation minimize these risks and demonstrate proactive security posture.

Examples

Real-world examples illustrate how attackers have leveraged the Web Services sub-technique:

APT29 (Cozy Bear) SolarWinds Attack:

Attackers used legitimate cloud infrastructure and web services (e.g., AWS, Azure) to host malicious payloads and conduct C2 communications.
Malicious traffic blended seamlessly into legitimate cloud service traffic, significantly complicating detection and response efforts.

FIN7 Campaigns:

FIN7 leveraged legitimate cloud storage services (such as Google Drive or Dropbox) to host malicious documents and payloads.
Victims received phishing emails containing trusted URLs, bypassing email security gateways and endpoint protection.

Magecart Web Skimming Attacks:

Attackers injected malicious JavaScript into legitimate e-commerce websites, leveraging compromised web servers to host skimming scripts.
Malicious scripts exfiltrated payment card data to attacker-controlled cloud services or domains, evading detection for extended periods.

Use of GitHub and Pastebin for C2 (Multiple Threat Actors):

Attackers frequently use GitHub repositories or Pastebin pastes to host C2 instructions or payloads.
Compromised systems regularly poll these legitimate services for commands, making detection challenging without behavioral analysis.

Cobalt Strike Beacon Hosted on Cloud Infrastructure:

Attackers deploy Cobalt Strike payloads hosted on legitimate cloud infrastructure (e.g., Amazon S3 buckets, Azure blobs).
Victims download and execute payloads from trusted URLs, bypassing traditional security controls and endpoint detection.

These examples underscore the diverse methods attackers use to exploit legitimate web services, highlighting the need for robust detection and response capabilities.