[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1567":3},{"item":4,"lessons":18,"controls":60,"related":89},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1567","T1567","Exfiltration Over Web Service",10,"MITRE","**What attackers do.** Attackers upload stolen data to legitimate web services, such as cloud storage, file transfer or code hosting sites, instead of their own servers. Traffic to these trusted services blends in and is often encrypted. This serves the Exfiltration tactic.\n\n**How to defend.** Restrict file sharing and cloud storage to approved corporate services, and use tenant restrictions to block personal accounts. Apply data loss prevention and cloud access security broker controls for uploads. Monitor for sync and transfer tools installed on servers.\n\n**Signs to look for.** Look for large uploads to cloud storage from servers or unusual users, use of command-line sync tools, and access to personal tenants. A common gap is blanket trust in popular cloud domains.","Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.\n\nWeb service providers also commonly use SSL\u002FTLS encryption, giving adversaries an added level of protection.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1567\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56],{"slug":21,"title":22,"published_at":23},"china-linked-hackers-built-commercial-portal-to-resell-stolen-government-emails","China-Linked Hackers Built Commercial Portal to Resell Stolen Government Emails","2026-10-08T20:21:18.219+00:00",{"slug":25,"title":26,"published_at":27},"ai-pentesting-tool-artex-weaponized-against-south-korean-financial-firms","AI Pentesting Tool ARTEX Weaponized Against South Korean Financial Firms","2026-10-08T16:22:00.204+00:00",{"slug":29,"title":30,"published_at":31},"antino-backdoor-abuses-microsoft-365-for-stealthy-c2-in-asia-espionage-campaign","Antino Backdoor Abuses Microsoft 365 for Stealthy C2 in Asia Espionage Campaign","2026-10-02T18:20:59.758+00:00",{"slug":33,"title":34,"published_at":35},"ai-powered-malware-autonomously-executes-post-compromise-attack-chains","AI-Powered Malware Autonomously Executes Post-Compromise Attack Chains","2026-09-22T20:21:14.78+00:00",{"slug":37,"title":38,"published_at":39},"vishing-token-theft-campaign-targets-executives-via-fake-it-calls","Vishing & Token Theft Campaign Targets Executives via Fake IT Calls","2026-09-07T18:20:45.153+00:00",{"slug":41,"title":42,"published_at":43},"macsync-stealer-uses-30-domains-to-exfiltrate-macos-data","MacSync Stealer Uses 30+ Domains to Exfiltrate macOS Data","2026-08-19T10:21:46.757+00:00",{"slug":45,"title":46,"published_at":47},"twinloot-malware-abuses-microsoft-cloud-to-evade-detection","TwinLoot Malware Abuses Microsoft Cloud to Evade Detection","2026-08-18T14:20:55.232+00:00",{"slug":49,"title":50,"published_at":51},"deadlock-ransomware-uses-blockchain-to-evade-takedowns","DeadLock Ransomware Uses Blockchain to Evade Takedowns","2026-08-12T00:20:22.918+00:00",{"slug":53,"title":54,"published_at":55},"deadlock-ransomware-uses-rust-and-decentralized-infrastructure-for-double-extortion","DeadLock Ransomware Uses Rust and Decentralized Infrastructure for Double Extortion","2026-08-10T18:21:59.219+00:00",{"slug":57,"title":58,"published_at":59},"hollowgraph-malware-abuses-microsoft-365-calendar-for-stealthy-c2","HOLLOWGRAPH Malware Abuses Microsoft 365 Calendar for Stealthy C2","2026-07-20T11:20:38.551+00:00",[61,66,71,75,80,85],{"slug":62,"name":63,"problem":64,"stories":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",7,{"slug":67,"name":68,"problem":69,"stories":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",5,{"slug":72,"name":73,"problem":74,"stories":70},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":76,"name":77,"problem":78,"stories":79},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":81,"name":82,"problem":83,"stories":84},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",2,{"slug":86,"name":87,"problem":88,"stories":84},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[90,96,101,106,110,114,118,122],{"family":91,"item":92,"code":93,"title":94,"together":95},"nist-800-53","si-4","SI-4","System Monitoring",8,{"family":97,"item":98,"code":99,"title":100,"together":95},"gdpr","32","Article 32","Security of processing",{"family":102,"item":103,"code":104,"title":105,"together":65},"cis","3","Control 3","Data Protection",{"family":97,"item":107,"code":108,"title":109,"together":70},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":102,"item":111,"code":112,"title":113,"together":70},"6","Control 6","Access Control Management",{"family":102,"item":115,"code":116,"title":117,"together":70},"13","Control 13","Network Monitoring and Defense",{"family":91,"item":119,"code":120,"title":121,"together":70},"ac-17","AC-17","Remote Access",{"family":123,"item":124,"code":125,"title":126,"together":70},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]