T1567.003sub-technique of T1567 Exfiltration Over Web Service
Exfiltration to Text Storage Sites
Linux · macOS · Windows · ESXinothing on this site yetT1567.003 on attack.mitre.org
Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as `pastebin[.]com`, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., Stage Capabilities), but adversaries may also use these sites to exfiltrate collected data.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Detection Strategy for Exfiltration to Text Storage Sites
- Unexpected processes (e.g., powershell.exe, wscript.exe, office apps) initiating HTTP POST/PUT requests to text storage domains like pastebin.com or hastebin.com, particularly when preceded by file access in sensitive directories.
- Use of curl, wget, or custom scripts to POST data to pastebin-like services. Defender perspective: identify chained behavior where files are compressed/read followed by HTTPS POST requests to text-sharing endpoints.
- Processes such as osascript, curl, or office applications sending data to text storage APIs/domains. Defender perspective: anomalous clipboard or file reads by unexpected applications immediately followed by outbound HTTPS requests to pastebin-like services.
- ESXi services (vmx, hostd) generating outbound HTTPS POST requests to text storage sites. Defender perspective: anomalous datastore or log reads chained with traffic to pastebin-like destinations.
what reduces it
- M1021 Restrict Web-Based Content. Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.