Drive-by Target (T1608.004) is a Resource Development sub-technique of Stage Capabilities. Its platform is PRE. The adversary prepares an environment to infect systems that visit a website during ordinary browsing, which is the groundwork for Drive-by Compromise.
If you run websites, this one has a second reading: your own site can be the staging ground.
How attackers use it
MITRE explains that the user's web browser is typically the target of exploitation, often with no extra user interaction once the page loads. Adversaries may also set up sites for non-exploitation goals, such as obtaining an application access token. Drive-by content can sit on infrastructure the adversary acquired or compromised.
The page lists ways to upload or inject malicious web content such as JavaScript:
- Inserting malicious scripts into web pages or user controllable content such as forum posts.
- Modifying script files served to websites from publicly writeable cloud storage buckets.
- Buying ad space through legitimate ad providers to run malicious advertisements (Malvertising).
Adversaries may also stage scripts that profile the visitor's browser, so they only deliver an exploit to targets of interest. Documented examples include: Threat Group-3390 embedding code that screens a visitor's IP address before exploiting the browser; FIN7 modifying download links on a compromised digital product website to point to trojanized versions; Mustard Tempest injecting JavaScript into compromised sites for drive-by downloads; and APT32 building sites full of scraped content, some pages carrying JavaScript that profiles visitors or pushes a fake software update.
How to detect it
MITRE notes that internet scanning may reveal staged content when patterns were previously identified, but most of this is outside your visibility. Defensive attention goes to related phases such as Drive-by Compromise and Exploitation for Client Execution.
If you operate websites, you can watch your own side:
- Monitor for unexpected changes to scripts and pages you serve, including third-party scripts.
- Review permissions on cloud storage buckets that host scripts. A publicly writeable bucket is a risk MITRE names directly.
- Check what ad providers and third-party tags your pages load.
For endpoints, watch for a browser spawning unexpected child processes or writing executables right after a page visit.
How to reduce the risk
MITRE's mitigation entry says this cannot easily be mitigated with preventive controls. In practice:
- Keep browsers and plugins patched, since the target is typically the browser.
- Make storage buckets that serve scripts read-only to the public.
- Use integrity controls such as subresource integrity for third-party scripts you load.
- Limit what a browser process may launch on endpoints.
Quick check
What storage misconfiguration does MITRE name for this technique?
Publicly writeable cloud storage buckets that serve script files to websites, where an adversary can modify the scripts.
Why would a staged page profile the visitor first?
To deliver an exploit only to visitors of interest, for example by screening the IP address, which makes the content harder to find by scanning.
