Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those…
Sub-technique of Web Service (T1102).
T1102.002 Web Service: Bidirectional Communication
title: "T1102.002 Web Service: Bidirectional Communication"
id: e890ca31-bfe5-436d-823a-32a712d45a7e
description: 'Detect Bidirectional Web Service C2 Channels via Process & Network Correlation. (Retargeted from the original process_creation label to network_connection — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TimeWindow, DomainPattern, PayloadSizeThreshold, ProcessNameExclusionList.'
references:
- https://attack.mitre.org/techniques/T1102/002
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
- attack.command-and-control
- attack.t1102.002
logsource:
category: network_connection
product: windows
service: sysmon
detection:
selection:
DestinationHostname|contains:
- 'pastebin.com'
- 'raw.githubusercontent.com'
- 'discord.com/api/webhooks'
condition: selection
falsepositives:
- Legitimate developer/IT use of these same public web services is common; treat as a weak signal requiring process-context correlation (e.g. powershell/cmd making the request rather than a browser).
level: medium
T1102.002 Web Service: Bidirectional Communication
title: "T1102.002 Web Service: Bidirectional Communication"
id: bbf00417-7a84-4361-b5b3-fc3124a67c5c
description: 'Detect Bidirectional Web Service C2 Channels via Process & Network Correlation. True bidirectional C2 (receive-command-then-post-output) requires correlating an inbound poll/GET with a later outbound POST to the same service across two events, which a single auditd process_creation detection cannot express (this would require a Sigma correlation rule referencing both legs). This rule is narrowed to a defensible proxy for the outbound/exfil leg only: curl or wget invoked with a data-upload flag targeting a known abusable web service, checked across argv positions a1-a6 rather than assuming a fixed position, since flags and URLs land in variable argv slots depending on invocation style. Tune using: UploadDirectionality, HostnameRegexList, ScriptParentName.'
references:
- https://attack.mitre.org/techniques/T1102/002
author: Shahrukh Khan
date: 2026-04-20
license: MIT
tags:
- attack.command-and-control
- attack.t1102.002
logsource:
category: process_creation
product: linux
detection:
selection_tool:
type: EXECVE
a0|endswith:
- '/curl'
- '/wget'
selection_flag:
- a1|contains: ['-d','--data','--data-binary','-F','--form','-T','--upload-file']
- a2|contains: ['-d','--data','--data-binary','-F','--form','-T','--upload-file']
- a3|contains: ['-d','--data','--data-binary','-F','--form','-T','--upload-file']
- a4|contains: ['-d','--data','--data-binary','-F','--form','-T','--upload-file']
- a5|contains: ['-d','--data','--data-binary','-F','--form','-T','--upload-file']
selection_dest:
- a1|contains: ['pastebin.com','discord.com/api','telegram.org','api.telegram.org']
- a2|contains: ['pastebin.com','discord.com/api','telegram.org','api.telegram.org']
- a3|contains: ['pastebin.com','discord.com/api','telegram.org','api.telegram.org']
- a4|contains: ['pastebin.com','discord.com/api','telegram.org','api.telegram.org']
- a5|contains: ['pastebin.com','discord.com/api','telegram.org','api.telegram.org']
- a6|contains: ['pastebin.com','discord.com/api','telegram.org','api.telegram.org']
condition: selection_tool and selection_flag and selection_dest
falsepositives:
- Upload directionality to legitimate web services is also used by developer tooling (bug-report uploaders, CI artifact publishers); this rule only observes the outbound leg and cannot itself confirm bidirectional C2 semantics without correlating a preceding inbound poll.
level: medium