T1567 Exfiltration Over Web Service — ATT&CK Technique
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Detection coverage (22)
- Suspicious Curl File Upload - Linux medium
- Potential Data Exfiltration Via Curl.EXE medium
- Communication To Ngrok Tunneling Service - Linux high
- Monero Crypto Coin Mining Pool Lookup high
- Network Connection Initiated To Cloudflared Tunnels Domains medium
- Network Connection Initiated To BTunnels Domains medium
- Process Initiated Network Connection To Ngrok Domain high
- Suspicious Non-Browser Network Communication With Telegram API medium
- Network Connection Initiated To Visual Studio Code Tunnels Domain medium
- Communication To Ngrok Tunneling Service Initiated high
- Arbitrary File Download Via ConfigSecurityPolicy.EXE medium
- LOLBAS Data Exfiltration by DataSvcUtil.exe medium
- O365 DLP Rule Triggered
- O365 Email Access By Security Administrator
- O365 Exfiltration via File Access
- O365 Exfiltration via File Download
- O365 Exfiltration via File Sync Download
- Linux Gdrive Binary Activity
- LOLBAS With Network Traffic
- Windows Gdrive Binary Activity
- Cisco TFTP Server Configuration for Data Exfiltration
- High Volume of Bytes Out to Url