Connection to Commonly Abused Web Services

  1[metadata]
  2creation_date = "2020/11/04"
  3integration = ["endpoint", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6[transform]
  7[[transform.investigate]]
  8label = "Alerts associated with the user in the last 48h"
  9providers = [
 10  [
 11    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
 12    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
 13  ]
 14]
 15relativeFrom = "now-48h/h"
 16relativeTo = "now"
 17
 18[[transform.investigate]]
 19label = "Alerts associated with the host in the last 48h"
 20providers = [
 21  [
 22    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
 23    { excluded = false, field = "host.name", queryType = "phrase", value = "{{host.name}}", valueType = "string" }
 24  ]
 25]
 26relativeFrom = "now-48h/h"
 27relativeTo = "now"
 28
 29[[transform.investigate]]
 30label = "Investigate the Subject Process Network Events"
 31providers = [
 32  [
 33    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" },
 34    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
 35  ]
 36]
 37
 38[[transform.osquery]]
 39label = "Osquery - Retrieve DNS Cache"
 40query = "SELECT * FROM dns_cache"
 41
 42[[transform.osquery]]
 43label = "Osquery - Retrieve All Services"
 44query = "SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"
 45
 46[[transform.osquery]]
 47label = "Osquery - Retrieve Services Running on User Accounts"
 48query = """
 49SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE
 50NOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR
 51user_account == null)
 52"""
 53
 54[[transform.osquery]]
 55label = "Osquery - Retrieve Service Unsigned Executables with Virustotal Link"
 56query = """
 57SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,
 58services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =
 59authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'
 60"""
 61
 62
 63[rule]
 64author = ["Elastic"]
 65description = """
 66Adversaries may implement command and control (C2) communications that use common web services to hide their activity.
 67This attack technique is typically targeted at an organization and uses web services common to the victim network, which
 68allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they
 69have most likely been used before compromise, which helps malicious traffic blend in.
 70"""
 71from = "now-9m"
 72index = ["logs-endpoint.events.network-*", "logs-sentinel_one_cloud_funnel.*"]
 73language = "eql"
 74license = "Elastic License v2"
 75name = "Connection to Commonly Abused Web Services"
 76note = """## Triage and analysis
 77
 78### Investigating Connection to Commonly Abused Web Services
 79
 80Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
 81
 82This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
 83
 84> **Note**:
 85> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 86> This investigation guide uses the [Investigate Markdown Plugin](https://www.elastic.co/guide/en/security/current/interactive-investigation-guides.html) introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 87
 88#### Possible investigation steps
 89
 90- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 91- Investigate other alerts associated with the user/host during the past 48 hours.
 92  - $investigate_0
 93  - $investigate_1
 94- Verify whether the digital signature exists in the executable.
 95- Identify the operation type (upload, download, tunneling, etc.).
 96- Examine the host for derived artifacts that indicate suspicious activities:
 97  - Analyze the process executable using a private sandboxed analysis system.
 98  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
 99    - Attempts to contact external domains and addresses.
100      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
101        - $investigate_2
102      - Examine the DNS cache for suspicious or anomalous entries.
103        - $osquery_0
104    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
105    - Examine the host services for suspicious or anomalous entries.
106      - $osquery_1
107      - $osquery_2
108      - $osquery_3
109  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
110
111### False positive analysis
112
113- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy false positives can be added as exceptions.
114
115### Response and remediation
116
117- Initiate the incident response process based on the outcome of the triage.
118- Isolate the involved host to prevent further post-compromise behavior.
119- If the triage identified malware, search the environment for additional compromised hosts.
120  - Implement temporary network rules, procedures, and segmentation to contain the malware.
121  - Stop suspicious processes.
122  - Immediately block the identified indicators of compromise (IoCs).
123  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
124- Remove and block malicious artifacts identified during triage.
125- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
126- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
127- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
128"""
129
130setup = """## Setup
131
132This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
133
134Setup instructions: https://ela.st/install-elastic-defend
135
136### Additional data sources
137
138This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
139
140- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
141"""
142
143references = [
144"https://www.elastic.co/security-labs/operation-bleeding-bear",
145"https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
146"https://specterops.io/blog/2026/01/30/weaponizing-whitelists-an-azure-blob-storage-mythic-c2-profile/"
147]
148risk_score = 21
149rule_id = "66883649-f908-4a5b-a1e0-54090a1d3a32"
150severity = "low"
151tags = [
152    "Domain: Endpoint",
153    "OS: Windows",
154    "Use Case: Threat Detection",
155    "Tactic: Command and Control",
156    "Resources: Investigation Guide",
157    "Data Source: Elastic Defend",
158    "Data Source: SentinelOne",
159    "Noise: High",
160    "Performance: Normal",
161    "Profile: Aggressive",
162    "Threat: Web Service Abuse",
163    "Rule Type: Event Correlation (EQL)",
164    "Platform: Windows",
165    "Resources: Osquery",
166]
167timestamp_override = "event.ingested"
168type = "eql"
169
170query = '''
171network where host.os.type == "windows" and
172    dns.question.name != null and process.name != null and
173    not (?user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") or user.domain == "NT AUTHORITY") and
174    /* Add new WebSvc domains here */
175    dns.question.name :
176       (
177        "raw.githubusercontent.*",
178        "pastebin.*",
179        "paste4btc.com",
180        "paste.ee",
181        "ghostbin.com",
182        "drive.google.com",
183        "?.docs.live.net",
184        "api.dropboxapi.*",
185        "content.dropboxapi.*",
186        "dl.dropboxusercontent.*",
187        "api.onedrive.com",
188        "*.onedrive.org",
189        "onedrive.live.com",
190        "filebin.net",
191        "*.ngrok.io",
192        "ngrok.com",
193        "*.portmap.*",
194        "*serveo.net",
195        "*localtunnel.me",
196        "*pagekite.me",
197        "*localxpose.io",
198        "*notabug.org",
199        "rawcdn.githack.*",
200        "paste.nrecom.net",
201        "zerobin.net",
202        "controlc.com",
203        "requestbin.net",
204        "slack.com",
205        "api.slack.com",
206        "slack-redir.net",
207        "slack-files.com",
208        "cdn.discordapp.com",
209        "discordapp.com",
210        "discord.com",
211        "apis.azureedge.net",
212        "cdn.sql.gg",
213        "?.top4top.io",
214        "top4top.io",
215        "www.uplooder.net",
216        "*.cdnmegafiles.com",
217        "transfer.sh",
218        "gofile.io",
219        "updates.peer2profit.com",
220        "api.telegram.org",
221        "t.me",
222        "meacz.gq",
223        "rwrd.org",
224        "*.publicvm.com",
225        "*.blogspot.com",
226        "api.mylnikov.org",
227        "file.io",
228        "stackoverflow.com",
229        "*files.1drv.com",
230        "api.anonfile.com",
231        "*hosting-profi.de",
232        "ipbase.com",
233        "ipfs.io",
234        "*up.freeo*.space",
235        "api.mylnikov.org",
236        "script.google.com",
237        "script.googleusercontent.com",
238        "api.notion.com",
239        "graph.microsoft.com",
240        "*.sharepoint.com",
241        "mbasic.facebook.com",
242        "login.live.com",
243        "api.gofile.io",
244        "api.anonfiles.com",
245        "api.notion.com",
246        "api.trello.com",
247        "gist.githubusercontent.com",
248        "files.pythonhosted.org",
249        "g.live.com",
250        "*.zulipchat.com",
251        "webhook.site",
252        "run.mocky.io",
253        "mockbin.org",
254        "*googleapis.com",
255        "global.rel.tunnels.api.visualstudio.com",
256        "*.devtunnels.ms",
257        "api.github.com",
258        "*.blob.core.windows.net",
259        "*.blob.storage.azure.net",
260        "files.catbox.moe",
261        "*.supabase.co",
262        "*.elastic-cloud.com",
263        "*.cloud.es.io",
264        "*icp0.io") and
265
266    /* Insert noisy false positives here */
267    not (
268      (
269        process.executable : (
270          "?:\\Program Files\\*.exe",
271          "?:\\Program Files (x86)\\*.exe",
272          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
273          "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
274          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
275          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
276          "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
277          "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
278          "?:\\Users\\*\\AppData\\Local\\PowerToys\\PowerToys.exe",
279          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
280          "?:\\Users\\*\\AppData\\Local\\Zen Browser\\zen.exe",
281          "?:\\Users\\*\\Wavesor Software\\WaveBrowser\\wavebrowser.exe",
282          "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
283          "?:\\Windows\\system32\\mobsync.exe",
284          "?:\\Windows\\SysWOW64\\mobsync.exe",
285          "?:\\Windows\\system32\\svchost.exe",
286          "?:\\Windows\\System32\\smartscreen.exe",
287          "?:\\Windows\\System32\\wsl.exe",
288          "?:\\Windows\\System32\\WWAHost.exe"
289        )
290      ) or
291
292      /* Discord App */
293      (process.name : "Discord.exe" and (process.code_signature.subject_name : "Discord Inc." and
294       process.code_signature.trusted == true) and dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
295      ) or
296
297      /* MS Sharepoint / OneDrive */
298      (process.name : ("Microsoft.SharePoint.exe", "OneDrive.Sync.Service.exe") and dns.question.name : "onedrive.live.com" and
299       (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
300      ) or
301
302      /* Obsidian - Plugins are stored on raw.githubusercontent.com */
303      (process.name : "Obsidian.exe" and (process.code_signature.subject_name : "Dynalist Inc" and
304       process.code_signature.trusted == true) and dns.question.name : "raw.githubusercontent.com"
305      ) or
306
307      /* WebExperienceHostApp */
308      (process.name : "WebExperienceHostApp.exe" and (process.code_signature.subject_name : "Microsoft Windows" and
309       process.code_signature.trusted == true) and dns.question.name : ("onedrive.live.com", "skyapi.onedrive.live.com")
310      ) or
311
312      /* IntelliJ IDEA connecting to raw.githubusercontent.com */
313      (process.code_signature.subject_name : "JetBrains s.r.o." and
314       process.code_signature.trusted == true and dns.question.name : ("api.github.com", "raw.githubusercontent.com")
315      ) or
316
317      (process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true and
318       dns.question.name : ("*.sharepoint.com", "graph.microsoft.com", "g.live.com", "login.live.com",
319                            "*.blob.core.windows.net", "*.blob.storage.azure.net", "*.googleapis.com")
320      ) or
321
322      (process.code_signature.subject_name : ("Python Software Foundation", "Anaconda, Inc.") and
323       process.code_signature.trusted == true and dns.question.name : "files.pythonhosted.org"
324      ) or
325
326      /* Zoom */
327      (process.name : "Zoom.exe" and (
328       process.code_signature.subject_name : ("Zoom Video Communications, Inc.", "Zoom Communications, Inc.") and
329       process.code_signature.trusted == true) and dns.question.name : ("*.googleapis.com", "graph.microsoft.com", "*.blob.core.windows.net")
330      ) or
331
332      /* VSCode */
333      (process.name : "Code.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
334       process.code_signature.trusted == true) and dns.question.name : ("api.github.com", "raw.githubusercontent.com",
335       "*.googleapis.com", "files.pythonhosted.org")
336      ) or
337
338      /* Terraform */
339      (process.name : "terraform-provider*.exe" and (process.code_signature.subject_name : "HashiCorp, Inc." and
340       process.code_signature.trusted == true) and dns.question.name : "graph.microsoft.com"
341      ) or
342
343      /* Telegram */
344      (process.name : "Telegram.exe" and (process.code_signature.subject_name : "Telegram FZ-LLC" and
345       process.code_signature.trusted == true) and dns.question.name : "*.googleapis.com"
346      ) or
347
348      (
349        process.code_signature.trusted == true and
350        process.code_signature.subject_name : (
351                              "Johannes Schindelin",
352                              "Redis Inc.",
353                              "Slack Technologies, LLC",
354                              "Cisco Systems, Inc.",
355                              "Dropbox, Inc",
356                              "Amazon.com Services LLC",
357                              "Island Technology Inc.",
358                              "GitHub, Inc.",
359                              "Red Hat, Inc",
360                              "Mozilla Corporation",
361                              "Spotify AB",
362                              "DeepL SE",
363                              "Google LLC",
364                              "Anthropic, PBC",
365                              "OpenAI OpCo, LLC",
366                              "Anysphere, Inc.",
367                              "PERPLEXITY AI, INC."
368        )
369      )
370    )
371'''
372
373
374[[rule.threat]]
375framework = "MITRE ATT&CK"
376
377[[rule.threat.technique]]
378id = "T1071"
379name = "Application Layer Protocol"
380reference = "https://attack.mitre.org/techniques/T1071/"
381
382[[rule.threat.technique.subtechnique]]
383id = "T1071.001"
384name = "Web Protocols"
385reference = "https://attack.mitre.org/techniques/T1071/001/"
386
387[[rule.threat.technique]]
388id = "T1090"
389name = "Proxy"
390reference = "https://attack.mitre.org/techniques/T1090/"
391
392[[rule.threat.technique.subtechnique]]
393id = "T1090.002"
394name = "External Proxy"
395reference = "https://attack.mitre.org/techniques/T1090/002/"
396
397[[rule.threat.technique]]
398id = "T1102"
399name = "Web Service"
400reference = "https://attack.mitre.org/techniques/T1102/"
401
402[[rule.threat.technique.subtechnique]]
403id = "T1102.001"
404name = "Dead Drop Resolver"
405reference = "https://attack.mitre.org/techniques/T1102/001/"
406
407[[rule.threat.technique.subtechnique]]
408id = "T1102.002"
409name = "Bidirectional Communication"
410reference = "https://attack.mitre.org/techniques/T1102/002/"
411
412[[rule.threat.technique]]
413id = "T1568"
414name = "Dynamic Resolution"
415reference = "https://attack.mitre.org/techniques/T1568/"
416
417[[rule.threat.technique.subtechnique]]
418id = "T1568.002"
419name = "Domain Generation Algorithms"
420reference = "https://attack.mitre.org/techniques/T1568/002/"
421
422[rule.threat.tactic]
423id = "TA0011"
424name = "Command and Control"
425reference = "https://attack.mitre.org/tactics/TA0011/"
426
427[[rule.threat]]
428framework = "MITRE ATT&CK"
429
430[[rule.threat.technique]]
431id = "T1567"
432name = "Exfiltration Over Web Service"
433reference = "https://attack.mitre.org/techniques/T1567/"
434
435[[rule.threat.technique.subtechnique]]
436id = "T1567.001"
437name = "Exfiltration to Code Repository"
438reference = "https://attack.mitre.org/techniques/T1567/001/"
439
440[[rule.threat.technique.subtechnique]]
441id = "T1567.002"
442name = "Exfiltration to Cloud Storage"
443reference = "https://attack.mitre.org/techniques/T1567/002/"
444
445[[rule.threat.technique.subtechnique]]
446id = "T1567.003"
447name = "Exfiltration to Text Storage Sites"
448reference = "https://attack.mitre.org/techniques/T1567/003/"
449
450[rule.threat.tactic]
451id = "TA0010"
452name = "Exfiltration"
453reference = "https://attack.mitre.org/tactics/TA0010/"