Drive-by compromise

The idea behind the Drive-by Compromise (T1189) technique is to gain access to the victim’s host by stealthily executing malicious code during normal browsing, often exploiting vulnerabilities in the browser itself or its extensions or obtaining an application access token. Groups such as DarkHotel, RTM, and Lazarus (https://www.hivepro.com/threat-advisory/north-korean-state-sponsored-threat-actor-lazarus-group-exploiting-chrome-zero-day-vulnerability/) have used legitimate sites to host malicious content and then compromise visitors to those sites.

Searching for traces of drive-by compromise will involve a combination of the techniques described earlier. First of all, since the technique is directly related to browsers, we will be interested in the resources visited by the user. For a more efficient search, we can use threat intelligence (TI) data and apply known bad comparisons to identify potentially compromised legitimate sites.

When using this...