Web Service
Web-service command traffic relays instructions through a legitimate online service.
What it means
Web-service command traffic relays instructions through a legitimate online service. Provider reputation does not establish that a particular account or resource is benign.
An investigation example
An unfamiliar process polls a collaboration service resource unrelated to the employee's approved work.
Evidence to examine
Correlate service resource identifiers, process identity, polling behavior, and retrieved content or follow-on execution.
A common analytical pitfall
Blocking an entire popular service can disrupt legitimate work while missing another resource used by the same actor.
Response considerations
Investigate resource-level use where available and apply proportionate containment based on the confirmed unauthorized channel.
A shared platform can mediate control messages
A web service can provide a place to publish, retrieve, or exchange information. In a command-and-control context, an intruder may use a legitimate platform as an intermediary rather than maintain a directly recognizable server. The provider's reputation does not establish that every account, object, or message on it is trusted.
Distinguish this role from ordinary file exfiltration. A service may carry instructions, destination information, or results, while another path moves collected data. Evidence should describe the specific function observed rather than apply every related technique label to one connection. Legitimate applications use the same platforms for approved automation and collaboration.
A fictional instruction lookup
An academy's endpoint process periodically retrieves an object from an unfamiliar workspace on a common platform. Shortly afterward, it changes its destination or performs an unexpected local action. Analysts compare object-access records, process activity, timing, and approved integrations. A retrieval alone does not prove that the object contained instructions.
Service-side records may require cooperation from the organization's provider account or responsible team. Preserve available identifiers and timestamps without assuming public visibility grants permission to access unrelated accounts. Encrypted transport can limit network inspection, while endpoint and application evidence may explain the sequence.
Compare provider and object trust
Create fictional examples of an approved automation object and an unapproved object on the same web platform. Identify the owner, purpose, requesting client, and evidence of use. Then state what would support a control-message interpretation rather than an ordinary content fetch. Use harmless prepared data.
Containment should consider the specific account or object, client process, and original access path. Blocking an entire collaboration platform can disrupt legitimate work and may not remove the component that uses it. A proportionate incident decision connects the concerning behavior to a defensible scope.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1102: Web Service