CmdID

CmdID / Techniques

T1102 Web Service

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. MITRE ATT&CK

3 Sigma rules T1102 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1102.002Web Service: Bidirectional Communication

Sigma rules tagged with it

process creation, the highest levels first

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems) · Windows

mediumCloudflared Tunnel Connections CleanupNasreddine Bencherchali (Nextron Systems) · Windows

mediumCloudflared Tunnel ExecutionJanantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) · Windows