<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-watering-hole-simulation
description: >-
  Simulate watering hole attacks by identifying high-value websites frequented
  by target organizations, deploying controlled exploit landing pages, and
  testing browser-based detection capabilities against strategic web compromise
  scenarios.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - watering-hole
  - strategic-web-compromise
  - drive-by-download
  - browser-exploit
  - web-compromise
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1189", "T1203", "T1059.007", "T1071.001"]
  frameworks: ["MITRE ATT&CK", "Lockheed Kill Chain", "OWASP"]
  tools: ["python3", "beef-xss", "mitmproxy", "selenium"]
---

# Building Watering Hole Simulation

## Overview

Watering hole simulation replicates strategic web compromise attacks where
adversaries inject malicious content into websites frequented by target
organizations. This technique tests web proxy filtering, browser isolation
controls, endpoint detection of drive-by downloads, and network-based
indicators of compromise detection when users visit compromised sites.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `BeEF` | Security tooling |
| `mitmproxy` | Security tooling |
| `web hosting infrastructure` | Security tooling |
| Authorized scope covering web-based attack simulation | Environment requirement |
| Controlled web server mimicking compromised watering hole site | Environment requirement |
| Web proxy and endpoint protection deployed for detection validation | Environment requirement |

## Workflow

### Step 1: Target Site Profiling

```bash
# Profile websites frequented by target organization
node scripts/agent.js profile --domain target.com --output site-profile.json

# Identify injectable content vectors on controlled test site
node scripts/agent.js analyze-site --url https://test-wateringhole.example.com
```

### Step 2: Deploy Watering Hole Infrastructure

```bash
# Configure controlled watering hole landing page
node scripts/agent.js deploy-site --template news-portal --payload browser-hook

# Inject controlled exploit redirect into test page
node scripts/agent.js inject --url https://test-wateringhole.example.com --vector iframe
```

### Step 3: Execute Drive-By Simulation

```bash
# Simulate user browsing to compromised site
node scripts/agent.js simulate-visit --url https://test-wateringhole.example.com --browser chrome

# Monitor browser hook callbacks and payload delivery
node scripts/agent.js monitor --campaign wateringhole-q1
```

### Step 4: Detection Validation and Reporting

```bash
# Generate watering hole simulation report
node scripts/agent.js report --campaign wateringhole-q1 --output wh-report.json
```

## Detection

```yaml
title: Watering Hole Simulation Detection
id: 5c52d33a-388e-4f7f-9b9b-29bfb8167ed0
status: experimental
description: Detects suspicious activity related to building watering hole simulation techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*watering*"
  condition: selection
level: high
tags:
  - attack.t1189
  - attack.t1203
  - attack.t1059.007
  - attack.t1071.001
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Watering Hole Simulation Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1189, T1203, T1059.007, T1071.001 |

## Verification

- [ ] Target site profile identifies realistic watering hole candidates
- [ ] Controlled infrastructure deployed without production impact
- [ ] Web proxy blocks or alerts on exploit redirect content
- [ ] Endpoint detection identifies drive-by download attempts
- [ ] Report documents detection gaps and hardening recommendations

## References

- [MITRE T1189](https://attack.mitre.org/techniques/T1189/) — Drive-by Compromise
- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) — Web application security testing
