1200KM / detection
T1102.003 One-Way Communication — Detection Rules
Detection workspace for T1102.003 One-Way Communication: 2 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- PwnDrp Access · test · critical · {"category":"proxy"}
- Raw Paste Service Access · test · high · {"category":"proxy"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0581 Detect One-Way Web Service Command Channels
AN1599 Analytic 1599
Suspicious process initiating outbound connections to web services without corresponding response or return traffic, indicative of one-way command channels.
AN1600 Analytic 1600
Curl, wget, or custom HTTP clients initiated by uncommon user accounts or cron jobs to popular web services, with no observed response parsing logic.
AN1601 Analytic 1601
Process using URLSession or similar API to fetch from web services without any response handling, indicative of one-way C2 channels.
AN1602 Analytic 1602
ESXi shell or scheduled tasks initiating outbound HTTPS to known public services without inbound return or loggable response, used to fetch instructions.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1102.003 simulation workspace
- Network Connection Creation · DC0082
- Network Traffic Content · DC0085
- Network Traffic Flow · DC0078
- Process Creation · DC0032
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.