T1102 Web Service — Detection Rules

Source-backed rule directory

• Communication To LocaltoNet Tunneling Service Initiated - Linux · test · high · {"category":"network_connection","product":"linux"}
• Communication To Ngrok Tunneling Service - Linux · test · high · {"product":"linux","category":"network_connection"}
• Network Connection Initiated To AzureWebsites.NET By Non-Browser Process · test · medium · {"category":"network_connection","product":"windows"}
• New Connection Initiated To Potential Dead Drop Resolver Domain · test · high · {"category":"network_connection","product":"windows"}
• Suspicious Non-Browser Network Communication With Google API · experimental · medium · {"product":"windows","category":"network_connection"}
• Communication To LocaltoNet Tunneling Service Initiated · test · high · {"category":"network_connection","product":"windows"}
• Process Initiated Network Connection To Ngrok Domain · test · high · {"category":"network_connection","product":"windows"}
• Communication To Ngrok Tunneling Service Initiated · test · high · {"category":"network_connection","product":"windows"}
• Potentially Suspicious Network Connection To Notion API · test · low · {"product":"windows","category":"network_connection"}
• Suspicious Non-Browser Network Communication With Telegram API · test · medium · {"product":"windows","category":"network_connection"}
• Cloudflared Tunnel Connections Cleanup · test · medium · {"category":"process_creation","product":"windows"}
• Cloudflared Tunnel Execution · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Child Process Of Manage Engine ServiceDesk · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1102 Web Service

MATCH(connection_to_disallowed_web_service_category OR known_c2_account_or_url) -> ALERT

• Proxy and Secure Web Gateway Logs
• Collaboration Platform Audit Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0425 Suspicious Use of Web Services for C2

AN1189 Analytic 1189

Detects unusual outbound connections to web services from uncommon processes using SSL/TLS, particularly those exhibiting high outbound data volume or persistence.

AN1190 Analytic 1190

Detects command-line tools, agents, or scripts making outbound HTTPS connections to popular web services like Discord, Slack, Dropbox, or Graph API in an unusual context.

AN1191 Analytic 1191

Detects user agents or background services making unauthorized or unscheduled web API calls to cloud/web services over HTTPS.

AN1192 Analytic 1192

Detects guest VMs or management agents issuing HTTP(S) traffic to external services without a valid patch management or backup justification.