// MITRE ATT&CK
T1567.003 · Exfiltration to Text Storage Sites
Sub-technique of T1567 · Exfiltration Over Web Service.
Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2...
How to detect & mitigate it
Detecting Exfiltration to Text Storage Sites starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1567
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.