Paste Bins - Code

Observable Types: domain

Description

Functionally similar to “paste bins” with the added features of code storage, allowing abuse for C2.

Unlike regular paste bins, many organizations may implicitly trust these services for development code snippets and training. These services may also allow updating of code snippets via API.

These are not IOCs, but legitimate services that may be leveraged by an actor. Use this list to mitigate organizational risk accordingly.

Techniques

• T1102.001
• T1204.004
• T1105
• T1567.003
• T1608.001

References

• https://authentic8.com/blog/what-is-pastebin-cyberthreat-intelligence/
• https://socradar.io/blog/top-5-paste-sites-used-by-threat-actors/
• https://community.hpe.com/t5/hpe-threat-labs/new-pastebin-like-service-used-in-multiple-malware-campaigns/ba-p/7265783

Lists

• IPv4 Text
• Domains Text
• CSV
• JSON