Detection of Command and Control Activity via Common Web Services

Adversaries frequently use command and control (C2) communications that leverage common web services to obfuscate their malicious activities within regular network traffic. This technique targets organizations by using web services commonly accessed within the victim's network, allowing malicious communications to blend in with legitimate traffic. Attackers prioritize popular services already in use before the compromise, further camouflaging the malicious traffic. This detection identifies processes communicating with web services known for abuse, such as file-sharing platforms, paste sites, and collaboration tools, while excluding known benign executables. The query specifically excludes common system processes and legitimate applications communicating with these services. The timeframe for analysis is set to nine months, allowing for detection of long-term C2 activities.

Attack Chain

1. Initial Access: An attacker gains initial access to a Windows host through an undisclosed method.
2. Malware Deployment: The attacker deploys malware that establishes a C2 channel using a common web service.
3. DNS Resolution: The malware resolves the DNS name of a commonly abused web service (e.g., pastebin.com) to establish communication.
4. Network Connection: The malware establishes an outbound network connection to the resolved IP address associated with the web service.
5. Data Exfiltration/Command Receiving: The malware sends exfiltrated data or receives commands from the attacker via the established connection to the web service.
6. Evasion: The malware attempts to evade detection by masquerading its traffic as legitimate communication with the web service.
7. Persistence: The malware establishes persistence to maintain C2 access across reboots, potentially through registry modifications or scheduled tasks.
8. Lateral Movement/Impact: Depending on the attacker's objectives, the C2 channel is used to facilitate lateral movement within the network and achieve the final impact, such as data theft or system compromise.

Impact

Successful exploitation enables attackers to establish a persistent C2 channel, exfiltrate sensitive data, and execute arbitrary commands on compromised systems. The use of common web services makes it difficult to distinguish malicious traffic from legitimate activity, potentially leading to prolonged undetected access. The impact includes potential data breaches, financial loss, reputational damage, and disruption of business operations. While the specific number of victims is unknown, organizations across various sectors are at risk.

Recommendation

• Deploy the provided Sigma rule to your SIEM and tune it to filter out legitimate connections specific to your environment, focusing on uncommon processes connecting to the listed web services (see rule: "Detect Suspicious Connection to Commonly Abused Web Services").
• Investigate alerts generated by the Sigma rule by examining the process execution chain and verifying the digital signatures of the executables involved (see rule: "Detect Web Service Abuse via PowerShell").
• Enable and monitor DNS query logs to identify hosts resolving domains associated with commonly abused web services (see logsource: dns_query).
• Implement network segmentation to restrict outbound connections from internal hosts to only necessary web services, reducing the attack surface for C2 communication.
• Use threat intelligence feeds to identify and block known malicious domains and IP addresses associated with C2 infrastructure.
• Enforce strict application whitelisting policies to prevent the execution of unauthorized executables that may be used for C2 communication.