EXPLORE
← Back to Explore
T1567

Exfiltration Over Web Service

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an ...

ESXiLinuxmacOSOffice SuiteSaaSWindows
44
Detections
3
Sources
4
Threat Actors

BY SOURCE

23elastic11sigma10splunk_escu

PROCEDURES (32)

Tunnel4 detections

Auto-extracted: 4 detections for tunnel

General Monitoring4 detections

Auto-extracted: 4 detections for general monitoring

Exfiltrat3 detections

Auto-extracted: 3 detections for exfiltrat

Unusual2 detections

Auto-extracted: 2 detections for unusual

Exfiltrat2 detections

Auto-extracted: 2 detections for exfiltrat

Azure2 detections

Auto-extracted: 2 detections for azure

Command And Control2 detections

Auto-extracted: 2 detections for command and control

Azure1 detections

Auto-extracted: 1 detections for azure

Credential1 detections

Auto-extracted: 1 detections for credential

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Lateral1 detections

Auto-extracted: 1 detections for lateral

Phish1 detections

Auto-extracted: 1 detections for phish

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Cloud1 detections

Auto-extracted: 1 detections for cloud

Service1 detections

Auto-extracted: 1 detections for service

Privilege1 detections

Auto-extracted: 1 detections for privilege

Azure1 detections

Auto-extracted: 1 detections for azure

Remote1 detections

Auto-extracted: 1 detections for remote

Http1 detections

Auto-extracted: 1 detections for http

Http1 detections

Auto-extracted: 1 detections for http

Credential1 detections

Auto-extracted: 1 detections for credential

Download1 detections

Auto-extracted: 1 detections for download

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

C21 detections

Auto-extracted: 1 detections for c2

Api1 detections

Auto-extracted: 1 detections for api

Unusual1 detections

Auto-extracted: 1 detections for unusual

Credential1 detections

Auto-extracted: 1 detections for credential

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Aws1 detections

Auto-extracted: 1 detections for aws

Email1 detections

Auto-extracted: 1 detections for email

Lateral1 detections

Auto-extracted: 1 detections for lateral

Download1 detections

Auto-extracted: 1 detections for download

DETECTIONS (44)

Arbitrary File Download Via ConfigSecurityPolicy.EXE
sigmamedium
AWS API Activity from Uncommon S3 Client by Rare User
elasticlow
AWS DynamoDB Scan by Unusual User
elasticlow
AWS DynamoDB Table Exported to S3
elasticlow
AWS EC2 Export Task
elasticmedium
AWS RDS Snapshot Export
elasticlow
AWS S3 Bucket Replicated to Another Account
elasticmedium
AWS SNS Rare Protocol Subscription by User
elasticlow
AWS SNS Topic Message Publish by Rare User
elasticmedium
Azure Storage Blob Retrieval via AzCopy
elasticmedium
Cisco TFTP Server Configuration for Data Exfiltration
splunk_escu
Communication To Ngrok Tunneling Service - Linux
sigmahigh
Communication To Ngrok Tunneling Service Initiated
sigmahigh
Connection to Commonly Abused Web Services
elasticlow
GitHub Exfiltration via High Number of Repository Clones by User
elasticmedium
GitHub Private Repository Turned Public
elasticlow
High Number of Closed Pull Requests by User
elasticmedium
High Number of Protected Branch Force Pushes by User
elasticmedium
High Volume of Bytes Out to Url
splunk_escu
Linux Gdrive Binary Activity
splunk_escu
LOLBAS Data Exfiltration by DataSvcUtil.exe
sigmamedium
LOLBAS With Network Traffic
splunk_escu
M365 OneDrive/SharePoint Excessive File Downloads
elasticmedium
Monero Crypto Coin Mining Pool Lookup
sigmahigh
Network Connection Initiated To BTunnels Domains
sigmamedium
Network Connection Initiated To Cloudflared Tunnels Domains
sigmamedium
Network Connection Initiated To Visual Studio Code Tunnels Domain
sigmamedium
Network Connection to OAST Domain via Script Interpreter
elastichigh
O365 DLP Rule Triggered
splunk_escu
O365 Email Access By Security Administrator
splunk_escu
O365 Exfiltration via File Access
splunk_escu
O365 Exfiltration via File Download
splunk_escu
O365 Exfiltration via File Sync Download
splunk_escu
Potential Data Exfiltration via Rclone
elasticmedium
Potential File Transfer via Certreq
elasticmedium
Potential File Transfer via Curl for Windows
elasticlow
Potential PowerShell HackTool Script by Function Names
elasticmedium
Process Initiated Network Connection To Ngrok Domain
sigmahigh
Several Failed Protected Branch Force Pushes by User
elasticmedium
Suspicious AWS S3 Connection via Script Interpreter
elasticmedium
Suspicious Curl File Upload - Linux
sigmamedium
Suspicious Non-Browser Network Communication With Telegram API
sigmamedium
Unusual Network Connection to Suspicious Web Service
elasticmedium
Windows Gdrive Binary Activity
splunk_escu