T1102.003 — One-Way Communication

Tactic: Command and Control · Platforms: Linux, macOS, Windows, ESXi

Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions.…

Sub-technique of Web Service (T1102).

Sigma detection rules (4)

title: "T1102.003 Web Service: One-Way Communication"
id: f500e2bc-9322-4c46-96c6-e6337c8d450a
description: 'Detects DNS lookups to popular external web services (paste sites, code-hosting raw content, cloud storage, chat/messaging platforms) that can be abused to push one-way C2 instructions to a compromised host. Windows DNS/network telemetry cannot distinguish one-way from two-way use of a web service, so this rule flags lookups to commonly-abused hosting/service domains as the closest defensible Windows-observable proxy. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: DestinationDomain, TimeWindow, ProcessName.'
references:
  - https://attack.mitre.org/techniques/T1102/003
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.003

logsource:
  category: dns_query
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '22'
    QueryName|contains:
      - 'pastebin.com'
      - 'raw.githubusercontent.com'
      - 'github.io'
      - 'herokuapp.com'
      - 'firebaseio.com'
      - 'firebaseapp.com'
      - 'drive.google.com'
      - 'docs.google.com'
      - 'dropbox.com'
      - 'discord.com'
      - 'discordapp.com'
      - 'telegram.org'
      - 't.me'
      - 'slack.com'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate developer, collaboration, or chat-app usage of these same services.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: "T1102.003 Web Service: One-Way Communication"
id: d03941fc-9c4b-4af2-9b11-e2d9af48532d
description: 'T1102.003 Web Service: One-Way Communication. NOTE: auditd cannot observe the defining "one-way" trait (absence of any return/response traffic on the same channel) since that is a negative, cross-session correlation outside what a single EXECVE event captures. Retargeted to the closest defensible Linux-observable proxy: a single shell invocation that fetches content from a public code/paste host known to be abused for C2 instructions AND pipes that fetched content directly into an interpreter (bash/sh/python/perl) for execution -- i.e. the web service is being used to deliver and immediately execute commands, which is the core C2-via-web-service behavior even though one-way vs bidirectional cannot be confirmed here. Tune using: ParentProcess, CommandLineArgs, destination-host allowlist.'
references:
  - https://attack.mitre.org/techniques/T1102/003
author: Shahrukh Khan
date: 2026-04-06
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_shell:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
    a1: '-c'
  selection_fetch_host:
    a2|contains:
      - 'raw.githubusercontent.com'
      - 'pastebin.com/raw'
      - 'paste.ee'
      - 'hastebin.com'
      - 'gist.githubusercontent.com'
  selection_pipe_to_interpreter:
    a2|contains:
      - '| bash'
      - '|bash'
      - '| sh'
      - '|sh'
      - '| python'
      - '|python'
      - '| perl'
      - '|perl'
  condition: selection_shell and selection_fetch_host and selection_pipe_to_interpreter

falsepositives:
  - Legitimate install scripts that fetch and pipe a setup script from GitHub raw/gist directly into bash (a common, if risky, distribution pattern); this cannot by itself confirm C2 use and should be paired with destination reputation/allowlisting.

level: medium

title: "T1102.003 Web Service: One-Way Communication"
id: 39d698f9-3636-4959-b525-0507dc4f985a
description: 'Detect One-Way Web Service Command Channels. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, EntropyScore.'
references:
  - https://attack.mitre.org/techniques/T1102/003
author: Shahrukh Khan
date: 2026-01-06
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.003

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    DestinationHostname|contains:
      - 'pastebin.com'
      - 'anonfiles.com'

  condition: selection

falsepositives:
  - Users legitimately viewing or downloading public pastes and shared files.

level: low

title: "T1102.003 Web Service: One-Way Communication"
id: 726a1f74-473d-4191-a5d4-0f03d679a172
description: 'Detect One-Way Web Service Command Channels. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScheduledTaskName, DestinationIP.'
references:
  - https://attack.mitre.org/techniques/T1102/003
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.command-and-control
  - attack.t1102.003

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains:
      - 'wget '
      - 'curl '
  selection_web:
    CommandLine|contains:
      - 'pastebin.com'
      - 'raw.githubusercontent.com'
      - 'discord.com'
      - 'telegram.org'

  condition: selection_tool and selection_web

falsepositives:
  - Legitimate download of packages or updates via curl or wget from public hosting services; shell.log only records interactively executed Tech Support Mode commands, so bidirectional channels driven by cron entries or non-interactive persistence are not captured here.

level: medium

Related sub-techniques

• T1102.002 Bidirectional Communication
• T1102.001 Dead Drop Resolver

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1102.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan