Dead Drop Resolver (T1102.001) is a sub-technique of Web Service and belongs to the command and control tactic. MITRE lists ESXi, Linux, macOS and Windows.
The idea: instead of baking a command server address into malware, the attacker posts a small piece of content on a popular site. The content holds an address, often encoded or obfuscated. Once infected, the victim fetches that content and is redirected to the real infrastructure.
How attackers use it
MITRE describes an adversary using an existing, legitimate external web service to host information that points to additional command and control infrastructure. Posted content carries embedded, often obfuscated or encoded, domains or IP addresses. Infected systems reach out to the resolver and are redirected.
Popular websites and social media give cover because hosts in your network likely already talk to them. TLS adds protection. MITRE also notes that the approach shields back-end infrastructure from discovery through binary analysis, and lets the attacker change that infrastructure at will, since only the posted content needs to change.
How to detect it
MITRE's strategy for this sub-technique looks for a process or script that accesses a common web service to retrieve content containing obfuscated indicators of a secondary command server.
What that means in logs:
- A non-browser process, script or service fetching a public page or profile on a popular site.
- A short fetch followed soon after by a first-time connection to an unrelated address.
- The same fetch repeating on a timer.
Correlating process-level network logs with proxy logs is the practical path. Sysmon event ID 3 records network connections on Windows, and your proxy shows the URL.
How to reduce the risk
MITRE lists two mitigations:
- Restrict web-based content. Use web proxies to enforce an external communication policy that blocks unauthorized external services.
- Network intrusion prevention, using signatures for specific malware.
Allow lists by server class help most. A build server has no reason to read social media pages.
Quick check
What does a dead drop resolver contain?
Often obfuscated or encoded domains or IP addresses that point to additional command and control infrastructure.
Why is it hard to block by domain?
The domain belongs to a popular, legitimate service your hosts already use, so blocking it is rarely an option. Focus on which processes may reach it.
Sources
- MITRE ATT&CK, Web Service: Dead Drop Resolver (T1102.001)
