A dead drop resolver is a covert command-and-control technique in which malware and its operator use a trusted third-party service as an exchange point. Instead of connecting directly to an attacker-owned server, the implant reads instructions from a shared object, such as a calendar event, document, profile field, or cloud note, and may write back status or stolen data in the same place. The “resolver” part refers to the malware interpreting that public or semi-public location as its source of truth.
This matters because the traffic looks like ordinary use of a legitimate service, which can bypass simple network blocks and blend into normal business activity. Defenders look for unusual API calls, suspicious app permissions, abnormal object changes, and access patterns that do not match the user or workload. Strong identity controls, consent review, audit logging, and monitoring of cloud telemetry are key defenses, especially when attackers abuse Microsoft 365, file-sharing platforms, or other trusted SaaS services.