{"id":"T1567.001","name":"Exfiltration to Code Repository","url":"https://attack.mitre.org/techniques/T1567/001","tactics":["exfiltration"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0318","stix_id":"x-mitre-detection-strategy--ac9c6b7c-bf94-4eeb-926c-f576673c0a14","name":"Detection Strategy for Exfiltration to Code Repository","url":"https://attack.mitre.org/detectionstrategies/DET0318","analytics":[{"id":"AN0895","stix_id":"x-mitre-analytic--7c7f0049-96af-4acc-9c58-9f8e661adb63","name":"Analytic 0895","description":"Processes such as PowerShell, Git, or curl initiating outbound HTTPS POST requests to known code repository APIs (e.g., github.com, gitlab.com) immediately following large file reads. Defender view: correlation between file access of sensitive directories (e.g., Documents, Finance) and abnormal data uploads to repository domains.","url":"https://attack.mitre.org/detectionstrategies/DET0318#AN0895","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredDomains","description":"List of external code repository domains to monitor (github.com, gitlab.com, bitbucket.org)."},{"field":"ExfilVolumeThreshold","description":"Threshold for outbound data volume per session to flag suspicious uploads."}],"live":true,"detection_strategies":["DET0318"],"techniques":["T1567.001"]},{"id":"AN0896","stix_id":"x-mitre-analytic--8049e0b4-961b-499f-9204-45fa9b7117be","name":"Analytic 0896","description":"Processes like git, curl, or python scripts executing commands that package files (tar, gzip) followed by HTTPS uploads to code repository endpoints. Defender view: detect unusual git push activity or scripted HTTPS requests outside normal developer work hours.","url":"https://attack.mitre.org/detectionstrategies/DET0318#AN0896","platforms":["Linux"],"log_source_references":[{"name":"auditd:EXECVE","channel":"git push, curl -X POST","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-execve"},{"name":"auditd:SYSCALL","channel":"open/read of sensitive directories","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"large outbound HTTPS uploads to repo domains","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"WorkHours","description":"Baseline normal developer activity periods to reduce false positives."},{"field":"RepoDomainList","description":"Known allowed internal or external repository domains."}],"live":true,"detection_strategies":["DET0318"],"techniques":["T1567.001"]},{"id":"AN0897","stix_id":"x-mitre-analytic--70b2ab8e-f18e-4cb5-8149-4ba2c334df69","name":"Analytic 0897","description":"Office or scripting applications initiating unusual HTTPS traffic to code repository APIs with high outbound-to-inbound ratios. Defender perspective: monitor for sensitive file access in combination with network connections to github.com, gitlab.com, or bitbucket.org.","url":"https://attack.mitre.org/detectionstrategies/DET0318#AN0897","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"execution of curl, git, or Office processes with network connections","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"read of user document directories","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"outbound HTTPS connections to code repository APIs","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"MonitoredApplications","description":"Applications not expected to upload large data sets to repos (Word, Excel, Preview)."}],"live":true,"detection_strategies":["DET0318"],"techniques":["T1567.001"]},{"id":"AN0898","stix_id":"x-mitre-analytic--e18f0682-6610-4ba8-8159-a4afea3b7974","name":"Analytic 0898","description":"ESXi host processes (vmx, hostd) initiating HTTPS sessions toward external code repositories. Defender perspective: detect datastore reads followed by outbound web traffic inconsistent with administrative baselines.","url":"https://attack.mitre.org/detectionstrategies/DET0318#AN0898","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"datastore file access","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"esxi-hostd"},{"name":"esxi:vmkernel","channel":"HTTPS traffic to repository domains","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"esxi-vmkernel"}],"mutable_elements":[{"field":"DatastoreTransferThreshold","description":"Amount of data moved from datastore to external services before raising alert."}],"live":true,"detection_strategies":["DET0318"],"techniques":["T1567.001"]}],"live":true,"version":"1.0","techniques":["T1567.001"]}],"sigma_rules":[{"id":"0c46d4f4-a2bf-4104-9597-8d653fc2bb55","title":"GitHub Repository Pages Site Changed to Public","author":"Ivan Saakov","status":"experimental","level":"low","date":"2025-10-18","modified":null,"description":"Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.\n","references":["https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site","https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms","https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events"],"logsource":{"product":"github","service":"audit"},"tags":["attack.collection","attack.exfiltration","attack.t1567.001"],"path":"rules/application/github/audit/github_pages_site_changed_to_public.yml","techniques":["T1567.001"],"cves":[]},{"id":"9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4","title":"Network Connection Initiated To DevTunnels Domain","author":"Kamran Saifullah","status":"test","level":"medium","date":"2023-11-20","modified":null,"description":"Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.\n","references":["https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","https://cydefops.com/devtunnels-unleashed"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.exfiltration","attack.command-and-control","attack.t1567.001","attack.t1572"],"path":"rules/windows/network_connection/net_connection_win_domain_devtunnels.yml","techniques":["T1567.001","T1572"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}