Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Web Services
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1583/006  external_id: T1583.006     source_name: FireEye APT29  description: FireEye Labs. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved September 17, 2015.  url: https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf     source_name: ThreatConnect Infrastructure Dec 2020  description: ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.  url: https://threatconnect.com/blog/infrastructure-research-hunting/     