ATT&CK T1189 Drive-by Compromise: Detection Guide

Drive-by Compromise (T1189) turns ordinary browsing into initial access: a user opens a page they had every reason to trust, and script on that page profiles the browser, delivers an exploit or a convincing fake download, and hands the adversary a foothold inside the network. ATT&CK v20 places T1189 under Initial Access (TA0001) on Windows, Linux, macOS and Identity Provider, because what follows a browser compromise is often a stolen session rather than a new process. This page takes the ATT&CK technique view: how groups have used it, the v20 detection strategy and its log sources, the five v20 mitigations turned into concrete browser and endpoint settings, and how to test. It is written for detection engineers, endpoint and browser owners. For the plain-language background on how drive-by downloads work, see the Drive-by Downloads Guide; this page does not repeat it.

Key takeaways

Trusted sites are the delivery channel. ATT&CK lists compromised legitimate sites, modified scripts served from writable cloud storage, malicious ads and cross-site scripting in legitimate web applications as the main delivery routes, so domain reputation alone will not stop it.
Detect the browser's children, not the page. v20 detection strategy DET0176 correlates a suspicious fetch with what the browser does next: unusual child processes, unsigned module loads, RWX memory and file drops within a short time window.
The identity provider sees the second half. Analytic AN0501 watches for new refresh tokens, consent grants and sign-ins from unfamiliar devices shortly after an endpoint alert, because session theft is a common payoff.
Fake updates are now as common as exploits. SocGholish (S1124) and Mustard Tempest (G1020) rely on compromised sites showing a fake browser update that the user runs, which is why script host control matters as much as patching.
Five mitigations, all configurable. M1048 isolation, M1050 exploit protection, M1021 web content restriction, M1051 updates and M1017 training map to specific browser policies and Windows settings listed below.

What T1189 is in ATT&CK v20

ATT&CK describes Drive-by Compromise as gaining access to a system through a user visiting a website over the normal course of browsing. Version 1.7 of the technique (last modified 24 October 2025) has no sub-techniques. It sits at the meeting point of three other techniques, each with its own page:

Before it: Drive-by Target (T1608.004) is the adversary preparing the site, and Malvertising (T1583.008) is buying ad placements to reach targets. See T1608 Stage Capabilities Defensive Guide and T1583 Acquire Infrastructure.
With it: Exploitation for Client Execution (T1203) is the browser or plugin exploit itself, and User Execution (T1204) covers cases where the visitor runs the payload, including approving browser push notifications that ATT&CK notes can grant a site the ability to run script. See T1204 User Execution.
Not to be confused with: Exploit Public-Facing Application (T1190), which attacks your servers. T1189 attacks the client endpoint and therefore usually lands inside the internal network rather than in a DMZ. See T1190 Exploit Public-Facing Application Defensive Guide.

ATT&CK's typical sequence is: the user visits the site, scripts fingerprint the browser and plugins, an exploit is delivered to a vulnerable version, and code runs on the endpoint. Some kits need a second visit before they deliver anything, which defeats one-shot sandbox detonation of a URL. When the site serves a specific community (a government portal, an industry association, a regional news site), the campaign is called a strategic web compromise or watering hole. The Watering Hole Attacks Guide covers that targeting model, and the Malvertising and SEO Poisoning Guide covers paid and search-based delivery.

How adversaries use it: recorded cases

ATT&CK v20 lists more than 40 groups, campaigns and malware families with T1189 procedure examples. A representative selection, each with its ATT&CK citation source:

Group, campaign or software	Recorded procedure	Defensive lesson
3CX Supply Chain Attack (C0057), AppleJeus (G1049)	Compromised the Trading Technologies website with a hidden iframe to exploit visitors; Mandiant reports Google TAG observed this in February 2022, linked to Chrome flaw CVE-2022-0609, two months before the same site served a trojanised X_TRADER installer that later led into 3CX	A drive-by on a vendor's site can precede a software supply chain compromise of that vendor's customers
Mustard Tempest (G1020) and SocGholish (S1124)	Injected JavaScript into legitimate sites, shown only to eligible Windows visitors, offering a fake browser update; Proofpoint observed the downloaded archive containing a JavaScript file run through wscript, followed by WMI profiling of the host	Block or monitor script hosts launched from the Downloads folder, and treat "update your browser" prompts on third-party sites as hostile
APT28 (G0007)	Strategic web compromise with custom exploit kits, and reflected cross-site scripting against government websites to redirect users to phishing pages (Google TAG, 2023)	XSS on a trusted domain can turn its reputation into a delivery channel
Dragonfly (G0035)	Strategic web compromise using a custom exploit kit (US-CERT TA18-074A and vendor reporting)	Critical infrastructure sector sites are a recurring watering hole target
Darkhotel (G0012)	Embedded iframes on hotel login portals to redirect selected guests to malware downloads	Captive portals and guest Wi-Fi pages are part of the attack surface for travelling staff
Andariel (G0138)	Watering holes, often with zero-day exploits, served only to visitors from a specific IP range	Targeted delivery means external scanners of the site may see nothing
Vidar (S9050)	Distributed through malicious search advertisements for "Notepad++"	Software downloads should come from an internal catalogue, not search results
Bad Rabbit (S0606)	Spread through watering holes by injecting JavaScript into a page's HTML or a .js file	Monitor and pin third-party scripts on your own sites so you are not the watering hole

The 3CX chain is also a reminder that your own public sites can be the delivery point. ATT&CK explicitly lists script files served from a publicly writable cloud storage bucket as a route, so bucket write permissions for web assets are part of T1189 defence. See the AML.T0078 Drive-by Compromise page for the AI system variant and the Mobile T1456 Drive-By Compromise page for phones and tablets.

What to detect and where

ATT&CK v20 detection strategy DET0176 (Drive-by Compromise, behaviour-based, multi-platform) has four analytics. All of them follow the same shape: a suspicious web fetch, then abnormal behaviour from the browser or the user's identity within a correlation window.

Analytic	Platform	Behaviour to correlate	Log sources named in v20
AN0498	Windows	Fetch from a previously unseen domain, then the browser spawning unusual children, loading unsigned modules, RWX allocations, file writes or registry changes	Security 4688, 4624 and 4648; Sysmon 3, 22 and 11; Microsoft-Windows-Kernel-Process ETW; browser application logs; HTTP flow content
AN0499	Linux	Uncommon fetch, then a browser or webview parent launching python, sh, ruby, curl or wget, staging in /tmp, and new outbound connections	auditd execve, syslog, Zeek or proxy HTTP logs, file creation in /tmp, /var/tmp and $HOME/.cache
AN0500	macOS	Safari or Chrome spawning interpreters or ad hoc binaries, unusual dylib loads, writes to /var/folders, /tmp, ~/Library/Caches or ~/Downloads	Unified log process and file events, proxy and HTTP logs
AN0501	Identity Provider	After an endpoint signal: atypical sign-ins, refresh token use from a new IP or user agent, consent grants or new OAuth client registrations	Entra ID sign-in logs, Microsoft 365 unified audit log, SaaS auth logs, AWS CloudTrail ConsoleLogin

Tuning the correlation

Time window: v20 exposes TimeWindow (fetch to process or file event) and IdpAlertWindow, which it suggests at 30 minutes to 2 hours for the identity half. Start there and shorten once you know your latency.
Known good domains: the KnownGoodDomainsList element is for high-volume corporate and CDN domains. Keep it small: a watering hole is by definition a site your users visit.
Payload entropy: PayloadEntropyThreshold surfaces packed or obfuscated script and binary downloads; HTTP responses with application/octet-stream for a script URL are another v20 indicator.
User context: separate build agents, kiosks and administrative service accounts (the UserContext and UserShellWhitelist elements) from end users, so shell execution from automation does not drown the analytic.

High-value single signals

Signal	Why it matters
chrome.exe, msedge.exe or firefox.exe as parent of cmd.exe, powershell.exe, wscript.exe, cscript.exe or mshta.exe	Browsers rarely launch shells or script hosts; this is the classic exploit or fake-update outcome
wscript.exe or cscript.exe running a .js file from the user's Downloads or a temporary archive folder	Matches the SocGholish delivery Proofpoint describes
Browser renderer process crashing repeatedly on one site (Windows events 1000 and 1001)	Failed exploitation often crashes the target before a success
New executable written by a browser process and run within minutes	Captures user-run downloads that never touch an exploit
Refresh token reuse from a new IP shortly after an endpoint alert on the same user	AN0501 pattern: the compromise has moved from device to identity

Mitigations as concrete settings

The five ATT&CK v20 mitigations for T1189, with settings an administrator can apply. Settings beyond the ATT&CK text are NHI Mgmt Group recommendations.

Mitigation	Setting or action	Notes
M1051 Update Software	Managed browser auto-update with a short deadline for restarts; remove legacy plugins and unsupported browsers	Browser zero-days are patched quickly; the gap is endpoints that have not restarted. See the Emergency Out-of-Band Patching Playbook
M1050 Exploit Protection	Windows exploit protection via Intune (Endpoint security, Attack surface reduction, profile Exploit Protection), Group Policy "Use a common set of exploit protection settings", or Set-ProcessMitigation	Microsoft supports Audit only for some mitigations; watch for crashes (events 1000, 1001) and hangs (1002) during the pilot. See M1050 Exploit Protection
M1048 Application Isolation and Sandboxing	Keep the browser sandbox intact (never run browsers with sandboxing disabled); use remote browser isolation for uncategorised or high-risk sites	ATT&CK notes sandbox escapes still exist, so isolation reduces impact rather than eliminating it. See the Remote Browser Isolation Guide
M1021 Restrict Web-Based Content	Chrome policy DefaultNotificationsSetting = 2 (BlockNotifications) with NotificationsAllowedForUrls for approved sites; ad blocking and script control for high-risk groups; DownloadRestrictions = 4 (block files Safe Browsing flags as malicious) or stricter where tolerated; SafeBrowsingProtectionLevel set to 1 or 2 and enforced	Chromium's policy documentation describes DownloadRestrictions value 4 as the recommended level; values 1 and 2 also block dangerous file types and generate more false positives
M1017 User Training	Teach that browsers update themselves and that a site asking you to "update your browser" or to allow notifications is a warning sign	Short, specific guidance works better than generic awareness content

Controls that block the payload stage

Script host control: change the default handler for .js, .jse, .vbs and .hta files to Notepad, or block wscript.exe and mshta.exe for standard users through application control. This breaks fake-update chains that need the user to run a script.
Application allow-listing: executables written by a browser to a user-writable path should not run without approval. See the Browser Security Hardening Guide for browser-side settings.
Software catalogue: publish an internal catalogue so users never need to search the web for tools, which removes the malvertising route used by Vidar and Grandoreiro (S0531).
Your own sites: lock down write access to buckets that serve web assets, use Subresource Integrity on third-party scripts and a Content Security Policy, so your site is not the next watering hole.

Where identity fits

The Identity Provider platform in T1189 reflects a real shift: many browser compromises aim at the session, not the device. A browser exploit or a fake update that installs an infostealer gives the adversary cookies and refresh tokens that bypass MFA, which ATT&CK models separately as Steal Web Session Cookie (T1539). The v20 identity analytic looks for consent grants and new OAuth client registrations, which links drive-by compromise to illicit application consent.

Correlate endpoint and IdP alerts by user: any DET0176 endpoint hit should trigger a look at that user's sign-ins and token use for the following hours, and session revocation if anything is odd.
Bind sessions to devices where the identity provider supports it, so a stolen refresh token fails on another machine.
Developers and administrators first: their browsers hold console sessions, cloud CLI tokens and access to secrets stores. A drive-by on a developer workstation can expose machine identities as well as the user's own.

See the MITRE ATT&CK T1539 Steal Web Session Cookie, the Infostealer Logs and Session Token Abuse Guide and the Consent Phishing and Illicit OAuth Grants Guide.

How to roll out and test

Inventory: list browsers, versions, extensions and plugins across the estate; remove unsupported browsers before anything else.
Policy pilot: apply notification blocking, Safe Browsing enforcement and DownloadRestrictions to an IT pilot ring for two weeks, collecting helpdesk tickets and blocked download reports.
Exploit protection in audit: deploy exploit protection settings with Audit only where available to a pilot group, watch events 1000, 1001 and 1002, then enforce in stages. Roll back by removing the app-level override, which restores the system value.
Detection build: deploy the browser-parent-to-script-host rule first (lowest noise), then the full DET0176 correlation, then the AN0501 identity correlation.
Emulate safely: in an approved test ring, use an authorised adversary emulation framework mapped to T1189 or a benign test page that triggers a harmless script download and execution, and confirm each layer fires. Never use live exploit kits.
Measure and widen: extend ring by ring, keeping the pilot ring one policy step ahead.

Metrics

Browser patch latency: median hours from a browser security release to 95% of endpoints running it.
Script host launches from browsers: count per month, with every instance triaged.
Blocked malicious downloads: trend by source category (ads, compromised sites, search).
Endpoint to identity correlation time: minutes from a DET0176 alert to session review or revocation for that user.
Policy coverage: percentage of managed browsers with notification, Safe Browsing and download policies enforced.

Common failure patterns

Restart debt: the update is downloaded but the browser has not been restarted for days, so the endpoint stays vulnerable while reporting as patched.
Relying on URL reputation: watering holes are reputable sites, and kits that serve only selected IP ranges or second visits defeat one-off URL checks.
Endpoint and identity alerts handled by different teams: the device is reimaged but the stolen session stays valid.
Script hosts left open: fake-update chains succeed without any exploit when a double-clicked .js file runs in wscript.
Allowing notifications by default: users click "allow" and grant persistent access to a hostile site.
Your site serving the attack: third-party scripts loaded without integrity checks, or web asset buckets with broad write access, let an adversary use your audience.

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK v20	T1189, TA0001, DET0176 (AN0498 to AN0501)	Technique, tactic and detection analytics
MITRE ATT&CK v20	M1048, M1050, M1021, M1051, M1017	Mitigations listed for T1189
MITRE ATT&CK v20	T1608.004, T1583.008, T1203, T1204, T1539	Preparation, execution and follow-on techniques (each has its own page)
NIST SP 800-53 Rev 5	SI-2, SI-3, SI-4, SC-18, SC-39, CM-7	Flaw remediation, malicious code protection, monitoring, mobile code, process isolation, least functionality
NIST CSF 2.0	PR.PS-02, PR.PS-05, DE.CM-01, DE.CM-09	Software maintenance, preventing unauthorised execution, network and endpoint monitoring

Practitioner checklist

Enforce browser auto-update with a restart deadline and remove unsupported browsers and plugins.
Set DefaultNotificationsSetting to block, with an allow-list for approved sites.
Enforce Safe Browsing and set DownloadRestrictions to at least 4.
Deploy Windows exploit protection settings in audit, then enforce in rings.
Stop .js, .vbs and .hta files opening in script hosts for standard users.
Alert on browsers spawning shells or script hosts, and build the DET0176 correlation.
Correlate endpoint browser alerts with IdP sign-in and token events for the same user and revoke sessions on a match.
Use remote browser isolation for uncategorised sites for high-risk roles.
Protect your own sites: integrity checks on third-party scripts and tight write access to web asset buckets.

MITRE ATT&CK T1189 Drive-by Compromise: Detecting and Blocking Browser-Based Initial Access