THREATNOIR
Subscribe
MITRE ATT&CK · T1567

Exfiltration Over Web Service

MITRE · cited in 10 of our lessons

Explanation

What attackers do. Attackers upload stolen data to legitimate web services, such as cloud storage, file transfer or code hosting sites, instead of their own servers. Traffic to these trusted services blends in and is often encrypted. This serves the Exfiltration tactic.

How to defend. Restrict file sharing and cloud storage to approved corporate services, and use tenant restrictions to block personal accounts. Apply data loss prevention and cloud access security broker controls for uploads. Monitor for sync and transfer tools installed on servers.

Signs to look for. Look for large uploads to cloud storage from servers or unusual users, use of command-line sync tools, and access to personal tenants. A common gap is blanket trust in popular cloud domains.

Open the technique on MITRE ATT&CK
The official text
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.