kevmap

Techniques › T1567 › T1567.004

T1567.004 Exfiltration Over Webhook

exfiltration — ESXi, Linux, macOS, Office Suite, SaaS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1567.004
0
KEV CVEs mapped here
<p>Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and webhook.site, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello. When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.</p><p>Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated Automated Exfiltration of emails, chat messages, and other data. Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.</p><p>Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1567.004

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1567) 12

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Suspicious Curl File Upload - Linux mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582
Detects a suspicious curl process start the adds a file to a web request
Techniques: T1567T1105
Potential Data Exfiltration Via Curl.EXE mediumtest
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
Techniques: T1567T1105
Process Initiated Network Connection To Ngrok Domain hightest
Author: Florian Roth (Nextron Systems) · 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670
Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Techniques: T1567T1572T1102
Communication To Ngrok Tunneling Service - Linux hightest
Author: Florian Roth (Nextron Systems) · 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Techniques: T1567T1568.002T1572T1090T1102
Communication To Ngrok Tunneling Service Initiated hightest
Author: Florian Roth (Nextron Systems) · 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Techniques: T1567T1568.002T1572T1090T1102
Arbitrary File Download Via ConfigSecurityPolicy.EXE mediumtest
Author: frack113 · 2021-11-26 (modified 2022-05-16) · logsource: product=windows category=process_creation · 1f0f6176-6482-4027-b151-00071af39d7e
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.
Techniques: T1567
Network Connection Initiated To Visual Studio Code Tunnels Domain mediumtest
Author: Kamran Saifullah · 2023-11-20 · logsource: product=windows category=network_connection · 4b657234-038e-4ad5-997c-4be42340bce4
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Techniques: T1567T1572
Network Connection Initiated To Cloudflared Tunnels Domains mediumtest
Author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems) · 2024-05-27 · logsource: product=windows category=network_connection · 7cd1dcdc-6edf-4896-86dc-d1f19ad64903
Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Techniques: T1567T1572
Network Connection Initiated To BTunnels Domains mediumtest
Author: Kamran Saifullah · 2024-09-13 · logsource: product=windows category=network_connection · 9e02c8ec-02b9-43e8-81eb-34a475ba7965
Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Techniques: T1567T1572
Monero Crypto Coin Mining Pool Lookup highstable
Author: Florian Roth (Nextron Systems) · 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641
Detects suspicious DNS queries to Monero mining pools
Techniques: T1496T1567
Suspicious Non-Browser Network Communication With Telegram API mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Techniques: T1102T1567T1105
LOLBAS Data Exfiltration by DataSvcUtil.exe mediumtest
Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger · 2021-09-30 (modified 2022-05-16) · logsource: product=windows category=process_creation · e290b10b-1023-4452-a4a9-eb31a9013b3a
Detects when a user performs data exfiltration by using DataSvcUtil.exe
Techniques: T1567