Techniques › T1567 › T1567.003
T1567.003 Exfiltration to Text Storage Sites
exfiltration — Linux, macOS, Windows, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1567.003
0
KEV CVEs mapped here
<p>Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as <code>pastebin[.]com</code>, are commonly used by developers to share code and other information.</p><p>Text storage sites are often used to host malicious code for C2 communication (e.g., Stage Capabilities), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.</p><p>Note: This is distinct from Exfiltration to Code Repository, which highlight access to code repositories via APIs.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0284 Detection Strategy for Exfiltration to Text Storage Sites v1.0
AN0787 WindowsUnexpected processes (e.g., powershell.exe, wscript.exe, office apps) initiating HTTP POST/PUT requests to text storage domains like pastebin.com or hastebin.com, particularly when preceded by file access in sensitive directories. Defender perspective: correlation of process lineage, large clipboard/file read operations, and outbound uploads to text storage services.Tunable:
TextStorageDomainsUploadSizeThresholdUserContextAN0788 LinuxUse of curl, wget, or custom scripts to POST data to pastebin-like services. Defender perspective: identify chained behavior where files are compressed/read followed by HTTPS POST requests to text-sharing endpoints.Tunable:AllowedToolsWorkHoursAN0789 macOSProcesses such as osascript, curl, or office applications sending data to text storage APIs/domains. Defender perspective: anomalous clipboard or file reads by unexpected applications immediately followed by outbound HTTPS requests to pastebin-like services.macos:unifiedlogexecution of curl, osascript, or unexpected Office processes→ DC0032 Process CreationTunable:WatchedAppsEntropyThresholdAN0790 ESXiESXi services (vmx, hostd) generating outbound HTTPS POST requests to text storage sites. Defender perspective: anomalous datastore or log reads chained with traffic to pastebin-like destinations.Tunable:DatastoreExfilThresholdApprovedDestinations
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1567.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1567) 12
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
· 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582
Detects a suspicious curl process start the adds a file to a web request
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update)
· 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
Author: Florian Roth (Nextron Systems)
· 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Florian Roth (Nextron Systems)
· 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: frack113
· 2021-11-26 (modified 2022-05-16) · logsource: product=windows category=process_creation · 1f0f6176-6482-4027-b151-00071af39d7e
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Author: Kamran Saifullah
· 2023-11-20 · logsource: product=windows category=network_connection · 4b657234-038e-4ad5-997c-4be42340bce4
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)
· 2024-05-27 · logsource: product=windows category=network_connection · 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Kamran Saifullah
· 2024-09-13 · logsource: product=windows category=network_connection · 9e02c8ec-02b9-43e8-81eb-34a475ba7965
Detects network connections to BTunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641
Detects suspicious DNS queries to Monero mining pools
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger
· 2021-09-30 (modified 2022-05-16) · logsource: product=windows category=process_creation · e290b10b-1023-4452-a4a9-eb31a9013b3a
Detects when a user performs data exfiltration by using DataSvcUtil.exe