Bidirectional Communication (T1102.002) is a sub-technique of Web Service in the command and control tactic. It applies to ESXi, Linux, macOS and Windows.
Here the legitimate web service carries both directions of the conversation. Commands go in. Output comes back out through the same channel.
How attackers use it
MITRE describes an adversary using an existing external web service to send commands to a compromised system and receive output from it. Infected systems may use popular websites and social media to host instructions. The return traffic depends on the service. MITRE gives examples such as posting a comment on a forum, issuing a pull request to a development project, updating a document hosted on a web service, or sending a Tweet.
As with other web service techniques, the cover comes from the fact that hosts already talk to these services, and TLS hides the content.
How to detect it
MITRE's strategy correlates process and network behavior. Its analytics describe:
- Suspicious processes making encrypted connections to common web service domains, followed by abnormal upload behavior or automated posting.
- Non-interactive system processes making HTTPS connections to well-known services, followed by high outbound volume or scripted upload patterns.
- Scripting engines such as osascript or Python making HTTPS requests to social media or content-sharing platforms, paired with automated response handling.
Look for non-human timing, posting from processes with no user session, and write actions (posts, comments, document edits) from hosts that should only read.
How to reduce the risk
MITRE lists two mitigations:
- Restrict web-based content with proxies that enforce external communication policy.
- Network intrusion prevention with signatures for specific malware.
A useful extra step: where your proxy can tell reads from writes, allow read-only access to services a server needs and block posts.
Quick check
How can output be returned over a web service?
MITRE lists examples such as a forum comment, a pull request to a development project, an update to a hosted document, or a Tweet.
What separates this from normal use of the service?
The source and pattern: a non-interactive process or script posting on a timer, with automated response handling, rather than a person using a browser.
Sources
- MITRE ATT&CK, Web Service: Bidirectional Communication (T1102.002)
