Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.
Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1567 | Exfiltration Over Web Service |
Comments
Adversaries transfer stolen data to external Web services. Dedicated administrative resources have no Internet egress, directly preventing connections to the external Web destinations required by the technique.
References
|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1567 | Exfiltration Over Web Service |
Comments
Web proxies and application-layer gateways can restrict which external web services are permitted, reducing unauthorized use of web services for data exfiltration.
References
|
| CIS-3.13 | Deploy a Data Loss Prevention Solution | mitigates | T1567 | Exfiltration Over Web Service |
Comments
DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. Web upload monitoring and restriction are core DLP use cases.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Export data | Export data to another site or system | related-to | T1567 | Exfiltration Over Web Service | |
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1567 | Exfiltration Over Web Service |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| chrome_enterprise_premium | Chrome Enterprise Premium | technique_scores | T1567 | Exfiltration Over Web Service |
Comments
Chrome Enterprise Premium provides Data Loss Prevention (DLP) features that can detect and block sensitive data for files that are uploaded and downloaded and for content that is pasted or dragged and dropped via the Chrome browser. This can provide protection against adversaries that may try to steal data over network protocols.
References
|
| cloud_ids | Cloud IDS | technique_scores | T1567 | Exfiltration Over Web Service |
Comments
Often used by adversaries to compromise sensitive data, Palo Alto Network's spyware signatures is able to detect data exfiltration attempts over command and control communications (e.g., WebShell).
Although there are ways an attacker could exfiltrate data from a compromised system, this technique was scored as significant based on Palo Alto Network's advanced threat detection technology which constantly updates to detect against the latest known variations of these attacks.
References
|
| security_command_center | Security Command Center | technique_scores | T1567 | Exfiltration Over Web Service |
Comments
SCC ingests BigQueryAudit data access logs used to track sensitive data that is saved outside of an organization or attempts to access protected resources. This security solution detects exfiltration attacks that were attempted and completed to an external or public resource. Because of the near-real time temporal factor this control was graded as significant.
References
|
| vpc_service_controls | VPC Service Controls | technique_scores | T1567 | Exfiltration Over Web Service |
Comments
This control is able to mitigate against exfiltration of data over a web service. Data contained within a VPC network perimeter can not be moved to a Google cloud resource or service outside of the perimeter but may be moved to third party services or storage.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1567 | Exfiltration Over Web Service |
Comments
The following finding types in GuardDuty flag events where adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command-and-control channel.
Exfiltration:S3/ObjectRead.Unusual Exfiltration:S3/MaliciousIPCaller Exfiltration:IAMUser/AnomalousBehavior Behavior:EC2/TrafficVolumeUnusual
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1567.004 | Exfiltration Over Webhook | 4 |
| T1567.001 | Exfiltration to Code Repository | 4 |
| T1567.003 | Exfiltration to Text Storage Sites | 6 |
| T1567.002 | Exfiltration to Cloud Storage | 9 |