Home
ATT&CK Techniques
T1583.006 Web Services

T1583.006 Web Services Mappings

Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service) or Exfiltration Over Web Service. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.

View in MITRE ATT&CK®

Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
action.hacking.variety.Forced browsing	Forced browsing or predictable resource location. Child of 'Exploit vuln'.	related-to	T1583.006	Acquire Infrastructure: Web Services
action.hacking.variety.Unknown	Unknown	related-to	T1583.006	Acquire Infrastructure: Web Services
action.malware.variety.Backdoor or C2	Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.	related-to	T1583.006	Acquire Infrastructure: Web Services
action.malware.variety.C2	Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.	related-to	T1583.006	Acquire Infrastructure: Web Services
value_chain.development.variety.Website	Development of any full website controlled by the attacker	related-to	T1583.006	Acquire Infrastructure: Web Services