T1567.004sub-technique of T1567 Exfiltration Over Web Service
Exfiltration Over Webhook
ESXi · Linux · macOS · Office Suite · SaaS · Windowsnothing on this site yetT1567.004 on attack.mitre.org
Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Detection Strategy for Exfiltration Over Webhook
- Unusual processes (e.g., powershell.exe, wscript.exe, mshta.exe) posting data to webhook endpoints (Discord, Slack, webhook.site) using HTTP POST/PUT requests. Defender perspective: suspicious process lineage followed by outbound HTTPS traffic to webhook domains.
- Processes such as curl, wget, or custom scripts initiating POST requests to webhook endpoints with encoded or bulk data. Defender perspective: abnormal chaining of file compression or access followed by outbound data to webhook URLs.
- Unexpected apps or scripts (osascript, curl, Automator workflows) exfiltrating data via webhooks. Defender perspective: correlation of clipboard/file read operations followed by HTTPS POST traffic to webhook services.
- VMware services or management daemons generating HTTP POST requests to webhook endpoints, chained with unusual datastore or log access. Defender perspective: exfiltration from VM logs or disk images over webhook URLs.
what reduces it
- M1057 Data Loss Prevention. Data loss prevention can be detect and block sensitive data being uploaded to web services via web browsers.