// MITRE ATT&CK
T1189 · Drive-by Compromise
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)), including: * A legitimate website is compromised, allow...
How to detect & mitigate it
Detecting Drive-by Compromise starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1195.001
Compromise Software Dependencies and Development Tools T1566.002
Spearphishing Link T1566.001
Spearphishing Attachment T1195.003
Compromise Hardware Supply Chain T1195
Supply Chain Compromise T1190
Exploit Public-Facing Application T1659
Content Injection T1199
Trusted Relationship
Compromise Software Dependencies and Development Tools T1566.002
Spearphishing Link T1566.001
Spearphishing Attachment T1195.003
Compromise Hardware Supply Chain T1195
Supply Chain Compromise T1190
Exploit Public-Facing Application T1659
Content Injection T1199
Trusted Relationship
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.