T1102.001Dead Drop Resolver
T1102.001 — Dead Drop Resolver is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 10 detection use cases covering it and 8 threat-intel articles citing it.
Command and Control
10Use cases
8Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1102 · Web Service
Use cases covering this technique (10)
[LLM] VS Code/Cursor extension host fetches dropper from nrwl/nx orphan commit on GitHub [LLM] macOS Python backdoor persistence via kitty-monitor LaunchAgent and cat.py drop [LLM] Outbound fetch of attacker-controlled autoimport VSIX from ColossusQuailPray GitHub release [LLM] node.exe contacting Solana JSON-RPC endpoints (suspected blockchain dead-drop C2) [LLM] ForceMemo: Python process queries Solana mainnet RPC endpoint (blockchain dead-drop C2) [LLM] GlassWorm Solana blockchain dead-drop C2 lookup via public RPC endpoints from Node [LLM] VSCode-family host fetching from raw.githubusercontent.com/BlokTrooper/extension path [LLM] DRILLAPP C2 staging: msedge.exe contacting pastefy.app [LLM] Inbound email with HTML attachment linking to unpkg.com Beamglea package [LLM] Beamglea mad-* dead-drop fetch from raw.githubusercontent.com/Abassdos2992Articles citing this technique (8)
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-434