T1189 — Drive-by Compromise

# T1189 - Drive-by Compromise

## SOC Recommendation
Investigate Drive-by Compromise activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Identifier Activity Analysis | Detect | Monitor for Identifier Activity Analysis indicators relevant to this technique. |
| Process Segment Execution Prevention | Harden | Apply Process Segment Execution Prevention to reduce this technique's viability before an incident occurs. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.
2. Check whether activity aligns with a planned change or approved business process.
3. Identify all affected users/devices/resources over the prior 24 hours.
4. Determine whether this is isolated or part of a broader campaign.
5. Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.
6. Elevate severity if privileged identities, critical systems, or repeated activity is observed.
7. Capture all evidence (query results, entities, timeline) in the incident record.
8. Route to the appropriate response playbook and customer escalation path.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain impacted identities/endpoints/sessions based on obse | Low | No | Yes |
| Block malicious indicators (IP, URL, domain, hash) where ava | Medium | No | Yes |
| Complete blast radius analysis across related logs and entit | Low | No | Yes |
| Notify stakeholders according to incident priority and custo | Low | Yes | No |
| Remove persistence or unauthorized access paths identified d | Low | No | Yes |
| Capture lessons learned and update rule tuning/watchlists. | Low | No | Yes |

## KQL
```kql
let Threshold = 1;  
 AzureDiagnostics
 | where Category == "ApplicationGatewayFirewallLog"
 | where action_s == "Matched"
 | project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s
 | join kind = inner(
 AzureDiagnostics
 | where Category == "ApplicationGatewayFirewallLog"
 | where action_s == "Blocked"
 | parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score
 | where Blocked_Reason contains "XSS" and toint(TotalInboundScore) >=15 and toint(XSS_Score) >= 10 and toint(SQLI_Score) <= 5) on transactionId_g
 | extend Uri = strcat(hostname_s,requestUri_s)
 | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, XSS_Score, TotalInboundScore
 | where Total_TransactionId >= Threshold
```
```kql
let Threshold = 1;
AzureDiagnostics
| where Category =~ "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "AnomalyScoring"
| where details_msg_s has "XSS"
| parse details_data_s with MessageText "Matched Data:" MatchedData "AND " * "table_name FROM " TableName " " *
| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData
| join kind = inner(
AzureDiagnostics
| where Category =~ "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "Block") on trackingReference_s
| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s
| where Total_TrackingReference >= Threshold
```
```kql
let Threshold = 3;  
AGWFirewallLogs
| where Action == "Matched"
| where Message has "XSS"
| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message
| join kind = inner(
AGWFirewallLogs
| where Action == "Blocked"
| extend transactionId_g = tostring(TransactionId)) on TransactionId
| extend Uri = strcat(Hostname,RequestUri)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action
| where Total_TransactionId >= Threshold
```

## Escalation Criteria
- Drive-by Compromise activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners
- Security testing or red-team exercise — Source identity/host matches approved test plan

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1189.json
• /api/recommendations/T1189.json
• /api/d3fend/T1189.json
• /api/mappings/T1189.json
• /api/confluence/T1189.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1189.json

Response:

{
  "technique_id": "T1189",
  "name": "Drive-by Compromise",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Initial Access"
  ],
  "platforms": [
    "Identity Provider",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may gain access to a system through a user visiting a website over the normal course of browsing...",
  "soc_recommendation": "Investigate Drive-by Compromise activity in the context of Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-IAA",
      "name": "Identifier Activity Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Identifier Activity Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-PSEP",
      "name": "Process Segment Execution Prevention",
      "relationship": "harden",
      "practical_action": "Apply Process Segment Execution Prevention to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-NTF",
      "name": "Network Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Confirm matching entities (user, host, IP) and validate data freshness in the lookback period.",
      "Check whether activity aligns with a planned change or approved business process.",
      "Identify all affected users/devices/resources over the prior 24 hours.",
      "Determine whether this is isolated or part of a broader campaign.",
      "Correlate with identity, endpoint, and email/cloud telemetry for related suspicious actions.",
      "Elevate severity if privileged identities, critical systems, or repeated activity is observed.",
      "Capture all evidence (query results, entities, timeline) in the incident record.",
      "Route to the appropriate response playbook and customer escalation path."
    ],
    "generic": [
      "Confirm whether the observed drive-by compromise activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Application Gateway WAF - XSS Detection\" -- Identifies a match for XSS attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement. References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)'"
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain impacted identities/endpoints/sessions based on obse",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Contain impacted identities/endpoints/sessions based on observed behavior."
    },
    {
      "name": "Block malicious indicators (IP, URL, domain, hash) where ava",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Block malicious indicators (IP, URL, domain, hash) where available."
    },
    {
      "name": "Complete blast radius analysis across related logs and entit",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Complete blast radius analysis across related logs and entities."
    },
    {
      "name": "Notify stakeholders according to incident priority and custo",
      "category": "Eradication",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Notify stakeholders according to incident priority and customer SLA."
    },
    {
      "name": "Remove persistence or unauthorized access paths identified d",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Remove persistence or unauthorized access paths identified during investigation."
    },
    {
      "name": "Capture lessons learned and update rule tuning/watchlists.",
      "category": "Recovery",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "d2bc08fa-030a-4eea-931a-762d27c6a042 — Application Gateway WAF - XSS Detection",
        "description": "Identifies a match for XSS attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement. References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Threshold = 1;  \n AzureDiagnostics\n | where Category == \"ApplicationGatewayFirewallLog\"\n | where action_s == \"Matched\"\n | project transactionId_g, hostname_s, requestUri_s, TimeGenerated, clientIp_s, Message, details_message_s, details_data_s\n | join kind = inner(\n AzureDiagnostics\n | where Category == \"ApplicationGatewayFirewallLog\"\n | where action_s == \"Blocked\"\n | parse Message with MessageText 'Total Inbound Score: ' TotalInboundScore ' - SQLI=' SQLI_Score ',XSS=' XSS_Score ',RFI=' RFI_Score ',LFI=' LFI_Score ',RCE=' RCE_Score ',PHPI=' PHPI_Score ',HTTP=' HTTP_Score ',SESS=' SESS_Score '): ' Blocked_Reason '; individual paranoia level scores:' Paranoia_Score\n | where Blocked_Reason contains \"XSS\" and toint(TotalInboundScore) >=15 and toint(XSS_Score) >= 10 and toint(SQLI_Score) <= 5) on transactionId_g\n | extend Uri = strcat(hostname_s,requestUri_s)\n | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g), Message = make_set(Message), Detail_Message = make_set(details_message_s), Detail_Data = make_set(details_data_s), Total_TransactionId = dcount(transactionId_g) by clientIp_s, Uri, action_s, SQLI_Score, XSS_Score, TotalInboundScore\n | where Total_TransactionId >= Threshold"
      },
      {
        "name": "b7643904-5081-4920-917e-a559ddc3448f — Front Door Premium WAF - XSS Detection",
        "description": "Identifies a match for an XSS attack in the Front Door Premium WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Threshold = 1;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"XSS\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold"
      },
      {
        "name": "1c7ff502-2ad4-4970-9d29-9210c6753138 — App Gateway WAF - XSS Detection",
        "description": "Identifies a match for an XSS attack in the App Gateway WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-community/attacks/xss/' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Threshold = 3;  \nAGWFirewallLogs\n| where Action == \"Matched\"\n| where Message has \"XSS\"\n| project TransactionId, Hostname, RequestUri, TimeGenerated, ClientIp, Message\n| join kind = inner(\nAGWFirewallLogs\n| where Action == \"Blocked\"\n| extend transactionId_g = tostring(TransactionId)) on TransactionId\n| extend Uri = strcat(Hostname,RequestUri)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TransactionID = make_set(transactionId_g,100), Message = make_set(Message,100), Total_TransactionId = dcount(transactionId_g) by ClientIp, Uri, Action\n| where Total_TransactionId >= Threshold"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "080bc66a-5d56-4d1f-8071-817671716db9 — Suspicious Browser Child Process",
        "description": "(EQL) Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n  process.parent.name like~ (\"Google Chrome\", \"Google Chrome Helper*\", \"firefox\", \"Opera\", \"Safari\", \"com.apple.WebKit.WebContent\", \"Microsoft Edge\") and\n  ((process.name like~ (\"sh\", \"bash\", \"dash\", \"ksh\", \"tcsh\", \"zsh\") and process.command_line : (\"*curl*\", \"*nscurl*\", \"*wget*\", \"*whoami*\", \"*pwd*\")) or\n  process.name like~ (\"curl\", \"wget\", \"python*\", \"perl*\", \"php*\", \"osascript\", \"pwsh\")) and\n  process.command_line != null"
      },
      {
        "name": "ac6bc744-e82b-41ad-b58d-90654fa4ebfb — WPS Office Exploitation via DLL Hijack",
        "description": "(EQL) Identifies the load of a remote library by the WPS Office promecefpluginhost.exe executable. This may indicate the successful exploitation of CVE-2024-7262 or CVE-2024-7263 via DLL hijack abusing the ksoqing custom protocol handler. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "any where host.os.type == \"windows\" and process.name : \"promecefpluginhost.exe\" and\n(\n (event.category == \"library\" and\n  ?dll.path :\n     (\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\wps\\\\INetCache\\\\*\",\n      \"\\\\Device\\\\Mup\\\\**\", \"\\\\\\\\*\")) or\n\n  ((event.category == \"process\" and event.action : \"Image loaded*\") and\n  ?file.path :\n     (\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\wps\\\\INetCache\\\\*\",\n      \"\\\\Device\\\\Mup\\\\**\", \"\\\\\\\\*\"))\n)"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Drive-by Compromise activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate admin or business workflow — Activity maps to approved change tickets or known process owners",
    "Security testing or red-team exercise — Source identity/host matches approved test plan"
  ],
  "confluence": {
    "title": "T1189 - Drive-by Compromise Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}