One-Way Communication (T1102.003) is a sub-technique of Web Service, in the command and control tactic. MITRE lists Linux, macOS, Windows and ESXi.
The attacker posts instructions on a legitimate service. The compromised host reads them. Output either goes over a different channel, possibly another web service, or does not come back at all.
How attackers use it
MITRE describes sending commands to a compromised system through an existing web service without receiving output over that channel. Infected systems may return results over a different command and control channel, including another distinct web service. Alternatively they may return nothing, in cases where the adversary wants to send instructions and does not want a response.
Because nothing is posted back, the host's traffic looks like someone reading a page. That is why it is quiet.
How to detect it
MITRE's strategy is Detect One-Way Web Service Command Channels. Analytics include:
- A suspicious process making outbound connections to web services with no corresponding response or return traffic.
- curl, wget or custom HTTP clients started by uncommon accounts or cron jobs against popular services, with no response parsing logic.
- A process using URLSession or a similar API on macOS to fetch from a web service without handling the response.
- ESXi shell or scheduled tasks making outbound HTTPS requests to public services to fetch instructions.
Look for regular fetches from scheduled jobs and service accounts to public sites, especially where the content is never otherwise used. Pair that with process lineage in your endpoint logs.
How to reduce the risk
MITRE lists two mitigations:
- Restrict web-based content with proxies enforcing external communication policy.
- Network intrusion prevention using signatures for specific malware.
Review cron jobs and scheduled tasks that make outbound requests, and remove those without an owner.
Quick check
Where does the output go in a one-way channel?
Either to a different command and control channel, including another web service, or nowhere if the adversary does not want a response.
What is a good first review item?
Scheduled jobs and non-interactive accounts that fetch from public web services, since that is the pattern MITRE describes.
Sources
- MITRE ATT&CK, Web Service: One-Way Communication (T1102.003)
