MITRE ATT&CKsub-technique

T1567.001 Exfiltration to Code Repository

Published 2020-03-09 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
ESXi, Linux, macOS, Windows
Version
1.2
Created
2020-03-09

Description

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1567 Exfiltration Over Web Service technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · uses (4)

  • S9043 Mini Shai-Hulud software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9008 Shai-Hulud software (malware)
  • S0363 Empire software (tool)

Referenced by Compliance · mitigates (4)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control