Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › Dead Drop Resolver Techniques

Dead Drop Resolver Techniques

2 min read

Jump to:

Overview

Dead Drop Resolver Techniques involve adversaries using intermediary infrastructure or services to retrieve data or commands covertly, often through third-party platforms or public resources. This technique supports stealthy communication and data exchange during various stages of an attack lifecycle, enabling attackers to avoid direct connections that could be detected or blocked.

Attack Objective

Maintain covert command and control or data retrieval channels
Supports Command & Control, Exfiltration, and sometimes Lateral Movement stages
Advances attacker position by enabling indirect communication paths that evade network defenses and monitoring

How the Technique Works

Adversaries place encrypted or encoded payloads, commands, or data in a publicly accessible or otherwise inconspicuous location, known as a dead drop. The compromised system or malware periodically queries this location to retrieve instructions or exfiltrate information. This indirect communication method reduces the likelihood of detection by avoiding direct connections to attacker-controlled infrastructure.

Common Methods & Variations

Use of public cloud storage services, paste sites, social media platforms, or DNS TXT records as dead drop locations
Variants include on-premises dead drops using shared network resources or cloud-based dead drops leveraging identity and access management features
Both living-off-the-land techniques (e.g., legitimate cloud APIs, DNS queries) and custom tooling are employed to interact with dead drops

Indicators of Compromise (IOCs)

Unusual or periodic access to uncommon external services or URLs from endpoints
Network traffic patterns showing repeated queries to public or third-party resources not typical for the environment
Artifacts such as encoded or encrypted blobs retrieved from unexpected locations
Authentication or API usage logs indicating anomalous access to cloud or web services

Detection Strategies

Monitoring network telemetry for anomalous outbound connections to non-standard services or domains
Behavioral analysis identifying periodic or scripted retrieval of data from public platforms
Correlation of endpoint process activity with network events to detect automated dead drop resolution

Mitigation & Prevention

Restrict and monitor access to external cloud storage, paste sites, and social media platforms from sensitive environments
Implement strict egress filtering and DNS monitoring to detect and block suspicious queries
Enforce least privilege access controls and multi-factor authentication for cloud and web services

Response Considerations

Immediately isolate affected systems to prevent further communication with dead drop locations
Investigate network logs and endpoint artifacts to identify the scope and timeline of dead drop usage
Remove or block access to identified dead drop resources and harden network controls to prevent recurrence

Related Techniques

Command and Control over Web Service
Data Staged for Exfiltration
Use of Alternate Protocols for Communication

Mapping & References

MITRE ATT&CK: Command and Control (TA0011), specifically techniques involving indirect communication channels
Public research on adversary use of cloud storage and public platforms for covert communications
Incident reports highlighting dead drop resolver usage in advanced persistent threat campaigns

Tags: Attack Lifecycle Cloud Security Command and Control Cybersecurity Techniques Dead Drop Resolver endpoint security Exfiltration MITRE ATT&CK network security Threat Detection