T1102.001 — Dead Drop Resolver

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses.…

Sub-technique of Web Service (T1102).

Sigma detection rules (4)

T1102.001 Web Service: Dead Drop Resolver

title: "T1102.001 Web Service: Dead Drop Resolver"
id: eead1847-340d-4b77-a201-a114b7888c25
description: 'Detects DNS resolution of paste/gist-style services by non-browser processes. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TargetDomain, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1102/001
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.001

logsource:
  category: dns_query
  product: windows
  service: sysmon

detection:
  selection_domains:
    QueryName|contains:
      - 'pastebin.com'
      - 'raw.githubusercontent.com'
      - 'gist.github.com'
      - 'paste.ee'
      - 'hastebin.com'
      - 'ghostbin.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  condition: selection_domains and not filter_browsers

falsepositives:
  - Legitimate developer tooling fetching from Gist/GitHub.

level: medium

T1102.001 Web Service: Dead Drop Resolver

title: "T1102.001 Web Service: Dead Drop Resolver"
id: 296fcec5-432f-42cd-a0df-6c4d362bd900
description: 'Detects execution of curl or wget fetching content from paste-style web services (pastebin raw, gist raw) commonly abused as dead-drop resolvers. Retargeted from an inconsistent network_connection logsource to process_creation/auditd, matching the EXECVE argv fields (a0/a1) actually used by this detection. Auditd process telemetry can only observe the fetch itself; it cannot see the fetched payload content, entropy, or any embedded C2 address, so this remains a coarse initial-access-to-C2-staging proxy rather than a definitive dead-drop-resolver detection. Tune using: TargetDomain, PayloadEntropyThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1102/001
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
    a1|contains:
      - 'pastebin.com/raw'
      - 'gist.githubusercontent.com'

  condition: selection

falsepositives:
  - Dead-drop resolver detection fundamentally depends on payload entropy/content analysis of the fetched page, which raw auditd command-line logging cannot provide; legitimate paste-based config pulls (CI/CD, documentation scripts) will also match this fetch pattern.

level: low

T1102.001 Web Service: Dead Drop Resolver

title: "T1102.001 Web Service: Dead Drop Resolver"
id: 12aa0fc3-e256-4c66-849e-cc2dd367b7b6
description: 'Detection Strategy for Web Service: Dead Drop Resolver. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TargetService, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1102/001
author: Shahrukh Khan
date: 2026-01-15
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.001

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    DestinationHostname|contains:
      - 'pastebin.com'
      - 'gist.github.com'
    Image|endswith: '/curl'

  condition: selection

falsepositives:
  - Legitimate scripts retrieving configuration snippets hosted on pastebin-like dead-drop services.

level: medium

T1102.001 Web Service: Dead Drop Resolver

title: "T1102.001 Web Service: Dead Drop Resolver"
id: 7eb4a1e4-5deb-49ee-8a5c-4eabae37d0a7
description: 'Detection Strategy for Web Service: Dead Drop Resolver. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DestinationIP, Protocol, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1102/001
author: Shahrukh Khan
date: 2026-05-27
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.001

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains:
      - 'wget '
      - 'curl '
  selection_deaddrop:
    CommandLine|contains:
      - 'pastebin.com'
      - 'raw.githubusercontent.com'
      - 'gist.github'
      - 'transfer.sh'

  condition: selection_tool and selection_deaddrop

falsepositives:
  - Administrators legitimately using wget or curl in the ESXi Shell to fetch VIBs, scripts, or documentation from public code-hosting sites; ESXi has no outbound DNS or proxy log to corroborate the resolver step, so this only catches transfers issued through an interactive or logged shell session.

level: medium

Related sub-techniques

Explore