Drive-by Compromise (T1189)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • Drive-by Compromise

Associated Tactics

  • Initial Access

Initial Access (TA0001)

The adversary is trying to get into your network. Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.

View on ATT&CK

Procedure Examples

Description Source(s)
Adair, S., Moran, N. (2012, May 15). Cyber Espionage & Strategic Web Compromises – Trusted Websites Serving Dangerous Results. Retrieved March 13, 2018. Shadowserver Strategic Web Compromise
Lassalle, D., et al. (2017, November 6). OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society. Retrieved November 6, 2017. Volexity OceanLotus Nov 2017