T1567 · Exfiltration Over Web Service

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1567 · Exfiltration Over Web Service · Sunturai

attack-patternenterprise-attackT1567

Exfiltration Over Web Service

attack-pattern--40597f16-0963-4249-bf4c-ac93b7fb9807

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Created: Mar 9, 2020, 12:51 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

4 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

111 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
AWS S3 Bucket Replicated to Another Account	High	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Anthropic High File Upload Activity	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Anthropic Excessive Chat Snapshot Creation	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Anthropic Artifact Shared Publicly	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Anthropic Organization Data Export Accessed	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Potential Third-Party Cloud Storage Client Execution	Medium	Elastic detection rules	Sep 29, 2026	Elastic License 2.0
Netskope - High Severity DLP Alert	High	Microsoft Sentinel analytics	Sep 26, 2026	MIT License
Network Connection to OAST Domain via Script Interpreter	High	Elastic detection rules	Sep 26, 2026	Elastic License 2.0
Potential Data Exfiltration via Rclone	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AzCopy or Azure Storage Explorer Usage on Unusual Host	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential File Transfer via Curl for Windows	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Connection to Commonly Abused Web Services	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential File Transfer via Certreq	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Network Connection to Suspicious Web Service	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious AWS S3 Connection via Script Interpreter	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual DNS Request to Suspicious Top Level Domain	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
M365 OneDrive/SharePoint Excessive File Downloads	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
High Number of Protected Branch Force Pushes by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Several Failed Protected Branch Force Pushes by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
High Number of Closed Pull Requests by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
GitHub Exfiltration via High Number of Repository Clones by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
GitHub Private Repository Turned Public	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Azure Storage Blob Retrieval via AzCopy	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS SNS Topic Message Publish by Rare User	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 111

Filter in the catalogue

External references

mitre-attackT1567Open reference

Platforms

ESXiLinuxmacOSOffice SuiteSaaSWindows

Kill chain phases

exfiltration

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object