MITRE ATT&CKtechnique

T1567 Exfiltration Over Web Service

Published 2020-03-09 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
ESXi, Linux, macOS, Office Suite, SaaS, Windows
Version
1.5
Created
2020-03-09

Description

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1057 Data Loss Prevention mitigation
  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · subtechnique of (4)

  • T1567.004 Exfiltration Over Webhook sub-technique
  • T1567.003 Exfiltration to Text Storage Sites sub-technique
  • T1567.001 Exfiltration to Code Repository sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique

Referenced by MITRE ATT&CK · uses (18)

  • S9045 BACKUPOSINT v9.0 APEX PREDATOR software (malware)
  • G1057 ShinyHunters group
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • C0059 Salesforce Data Exfiltration campaign
  • G1052 Contagious Interview group
  • S1245 InvisibleFerret software (malware)
  • C0051 APT28 Nearest Neighbor Campaign campaign
  • S1179 Exbyte software (malware)
  • G1043 BlackByte group
  • S1171 OilCheck software (malware)
  • S1168 SampleCheck5000 software (malware)
  • S0508 ngrok software (tool)
  • C0017 C0017 campaign
  • S0622 AppleSeed software (malware)
  • S0547 DropBook software (malware)
  • G0082 APT38 group
  • G0059 Magic Hound group
  • G0007 APT28 group

Referenced by Compliance · mitigates (20)

  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-3.13 Deploy a Data Loss Prevention Solution CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-3 Information Exchange NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control