// MITRE ATT&CK
T1567 · Exfiltration Over Web Service
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already com...
How to detect & mitigate it
Detecting Exfiltration Over Web Service starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Sub-techniques (4)
T1567.001
Exfiltration to Code Repository T1567.002
Exfiltration to Cloud Storage T1567.003
Exfiltration to Text Storage Sites T1567.004
Exfiltration Over Webhook
Exfiltration to Code Repository T1567.002
Exfiltration to Cloud Storage T1567.003
Exfiltration to Text Storage Sites T1567.004
Exfiltration Over Webhook
Related techniques
T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.