T1567 Exfiltration Over Web Service

exfiltration — ESXi, Linux, macOS, Office Suite, SaaS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1567

KEV CVEs mapped here

<p>Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.</p><p>Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2025-54309	CrushFTP CrushFTP	primary impact	Mapped	2025-07-22
CVE-2024-11182	MDaemon Email Server	primary impact	Mapped	2025-05-19
CVE-2022-41082	Microsoft Exchange Server	secondary impact	Mapped	2022-09-30

Detection strategy · ATT&CK Enterprise v19.2

DET0548 Detection Strategy for Exfiltration Over Web Service v1.0
AN1511 Windows
Processes that normally do not initiate network communications suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios. Defender view: correlation between process creation logs (e.g., Word, Excel, PowerShell) and subsequent anomalous network traffic volumes toward common web services (Dropbox, Google Drive, OneDrive).

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

Tunable: MonitoredServices ExfilVolumeThreshold TimeWindow

AN1512 Linux
Processes (tar, curl, python scripts) accessing large file sets and initiating outbound HTTPS POST requests with payload sizes inconsistent with baseline activity. Defender perspective: detect abnormal sequence of file archival followed by encrypted uploads to external web services.

auditd:EXECVE curl or wget with POST/PUT options → DC0064 Command Execution
auditd:SYSCALL open/read of sensitive directories (/etc, /home/*) → DC0055 File Access
NSM:Flow sustained outbound HTTPS sessions with high data volume → DC0078 Network Traffic Flow

Tunable: MonitoredTools DataVolumeThreshold

AN1513 macOS
Office apps or scripts writing files followed by xattr manipulation (to evade quarantine) and subsequent HTTPS uploads. Defender perspective: anomalous file modification + outbound TLS traffic originating from non-networking apps (Word, Excel, Preview).

macos:unifiedlog execution of Office binaries with network activity → DC0032 Process Creation
macos:unifiedlog read/write of user documents prior to upload → DC0055 File Access
macos:unifiedlog outbound TLS connections to cloud storage providers → DC0085 Network Traffic Content

Tunable: WatchedApplications

AN1514 SaaS
Abnormal API calls from user accounts invoking file upload endpoints outside normal baselines (M365, Google Drive, Box). Defender perspective: monitor unified audit logs for elevated frequency of Upload, Create, or Copy operations from compromised accounts.

m365:unified FileUploaded or FileCopied events → DC0038 Application Log Content
saas:box API calls exceeding baseline thresholds → DC0085 Network Traffic Content

Tunable: APICallThreshold UserBaselineProfiles

AN1515 ESXi
ESXi guest OS or management interface processes establishing unexpected external HTTPS connections. Defender perspective: monitor vmx or hostd processes making outbound web requests with significant data transfer.

esxi:vmkernel network session initiation with external HTTPS services → DC0082 Network Connection Creation
esxi:hostd file copy or datastore upload via HTTPS → DC0055 File Access

Tunable: DatastoreTransferThreshold

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1567`

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Process Initiated Network Connection To Ngrok Domain hightest

Author: Florian Roth (Nextron Systems) · 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670

Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Techniques: T1567 T1572 T1102

Communication To Ngrok Tunneling Service - Linux hightest

Author: Florian Roth (Nextron Systems) · 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Techniques: T1567 T1568.002 T1572 T1090 T1102

Communication To Ngrok Tunneling Service Initiated hightest

Author: Florian Roth (Nextron Systems) · 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Techniques: T1567 T1568.002 T1572 T1090 T1102

Arbitrary File Download Via ConfigSecurityPolicy.EXE mediumtest

Author: frack113 · 2021-11-26 (modified 2022-05-16) · logsource: product=windows category=process_creation · 1f0f6176-6482-4027-b151-00071af39d7e

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

Techniques: T1567

Network Connection Initiated To Visual Studio Code Tunnels Domain mediumtest

Author: Kamran Saifullah · 2023-11-20 · logsource: product=windows category=network_connection · 4b657234-038e-4ad5-997c-4be42340bce4

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1567 T1572

Network Connection Initiated To Cloudflared Tunnels Domains mediumtest

Author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems) · 2024-05-27 · logsource: product=windows category=network_connection · 7cd1dcdc-6edf-4896-86dc-d1f19ad64903

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1567 T1572

Network Connection Initiated To BTunnels Domains mediumtest

Author: Kamran Saifullah · 2024-09-13 · logsource: product=windows category=network_connection · 9e02c8ec-02b9-43e8-81eb-34a475ba7965

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1567 T1572

Monero Crypto Coin Mining Pool Lookup highstable

Author: Florian Roth (Nextron Systems) · 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641

Detects suspicious DNS queries to Monero mining pools

Techniques: T1496 T1567

Suspicious Non-Browser Network Communication With Telegram API mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Techniques: T1102 T1567 T1105

LOLBAS Data Exfiltration by DataSvcUtil.exe mediumtest

Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger · 2021-09-30 (modified 2022-05-16) · logsource: product=windows category=process_creation · e290b10b-1023-4452-a4a9-eb31a9013b3a

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Techniques: T1567

Sub-techniques

ID	Name	Sigma rules
T1567.001	Exfiltration to Code Repository	2
T1567.002	Exfiltration to Cloud Storage	14
T1567.003	Exfiltration to Text Storage Sites	0
T1567.004	Exfiltration Over Webhook	0

T1567 Exfiltration Over Web Service

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1567

Sub-techniques

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1567`