// MITRE ATT&CK
T1567 · Exfiltration Over Web Service
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already com...
¿Cómo detectarlo y mitigarlo?
La detección de Exfiltration Over Web Service parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (4)
T1567.001
Exfiltration to Code Repository T1567.002
Exfiltration to Cloud Storage T1567.003
Exfiltration to Text Storage Sites T1567.004
Exfiltration Over Webhook
Exfiltration to Code Repository T1567.002
Exfiltration to Cloud Storage T1567.003
Exfiltration to Text Storage Sites T1567.004
Exfiltration Over Webhook
Técnicas relacionadas
T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.