What is a drive-by compromise?¶

A drive-by compromise occurs when visiting or loading online content leads to unauthorised activity on the device, sometimes with little or no further user action.

Avoid the dangerous assumption¶

The dangerous assumption is that the user must have deliberately downloaded and opened malware.

They may not have.

The compromise may involve:

• a malicious or compromised website
• a browser vulnerability
• a malicious advertisement
• a redirect chain
• a deceptive update prompt
• automatic script execution
• a download triggered by page content.

Investigators should establish:

• which page was visited
• how the user reached it
• what browser and version were used
• what content loaded
• whether redirection occurred
• whether a file was downloaded
• whether code executed
• what activity followed.

Evidence may exist in browser history, cache, downloads, DNS and proxy logs, endpoint telemetry, memory, website captures and security alerts.

A visit to a compromised website does not automatically prove exploitation.

The required vulnerability may not have existed.

The malicious content may have been blocked.

The page may have served different content to different visitors.

Likewise, the absence of a downloaded file does not exclude memory-only or script-based activity.

Do not assume the website owner was the offender. The site or advertising supply chain may itself have been compromised.

Where advertising, scripts or third-party content were involved, preserve the provider and campaign identifiers. The same webpage may not reproduce the malicious delivery later because content was selected dynamically.

Operational takeaway¶

Reconstruct the visit, browser state, delivered content and resulting device activity before concluding that online content caused a drive-by compromise.