Threat actors may register for web services that can be used during targeting. A variety of popular websites exist for Threat actors to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for Threat actors to hide in expected noise. By utilizing a web service, Threat actors can make it difficult to physically tie back operations to them.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.