T1567
Exfiltration Over Web Service
ESXi · Linux · macOS · Office Suite · SaaS · Windows9 pieces on this siteT1567 on attack.mitre.org
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware response plan: from the first renamed file to the review
The whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.
An extortion demand, and nothing is encrypted
A message to staff, executives or a public address claiming to hold your data and demanding payment, often with a sample or a file listing, while every system is running normally.
Data theft extortion response plan: verify the claim, find the way out, own the notification
An extortion demand with nothing encrypted, or your name on a leak site. Three questions run in parallel with three owners: is the claim real, what left and how, and what you are obliged to say and to whom. A plan for answering each one on evidence rather than on the attacker's framing.
Insider threat response plan: evidence, proportion and the employee who may have done nothing
The response where the usual instincts are wrong. Speed matters less than lawfulness, the suspect is a colleague with rights, and half of these turn out to be misunderstanding. A plan for investigating quietly, preserving what you would need, and being able to stand behind how you did it.
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
Data leaving with a person
A resignation with an unusual access pattern behind it, a bulk download, or a report from a manager.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
A file transfer appliance wrote a file to itself
Say what happened, in what order, and what you need to establish before anybody says the word "contained".
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
Read
Analyses, case studies, guides, references and interview questions.
Case study: one appliance, and the disclosure that followed
CL0P against MOVEit Transfer, worked as a case rather than read as news. A zero-day in an internet-facing file transfer product, a web shell, and a scope question that has nothing to do with how many hosts were touched. Nine questions, and the answers are in the advisory.
how MITRE says to see it
Detection Strategy for Exfiltration Over Web Service
- Processes that normally do not initiate network communications suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios. Defender view: correlation between process creation logs (e.g., Word, Excel, PowerShell) and subsequent anomalous network traffic volumes toward common web services...
- Processes (tar, curl, python scripts) accessing large file sets and initiating outbound HTTPS POST requests with payload sizes inconsistent with baseline activity. Defender perspective: detect abnormal sequence of file archival followed by encrypted uploads to external web services.
- Office apps or scripts writing files followed by xattr manipulation (to evade quarantine) and subsequent HTTPS uploads. Defender perspective: anomalous file modification + outbound TLS traffic originating from non-networking apps (Word, Excel, Preview).
- Abnormal API calls from user accounts invoking file upload endpoints outside normal baselines (M365, Google Drive, Box). Defender perspective: monitor unified audit logs for elevated frequency of Upload, Create, or Copy operations from compromised accounts.