T1567 Exfiltration Over Web Service

Technique

T1567

Tactics

Exfiltration

Research, 90 days

2

KEV CVEs mapped

3

SigmaHQ rules

12

Elastic, Splunk

49

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1567

MITRE description

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2025-54309
• CVE-2024-11182
• CVE-2022-41082

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-03 ESET: Gorbag: Orcs at the border harvesting intelligence from Ukraine
• 2026-10-30 Darktrace: CikaBika Bot: Inside a Discord RAT Campaign

Detection coverage

SigmaHQ community rules

• Potential Data Exfiltration Via Curl.EXE (threat-hunting)
• Communication To Ngrok Tunneling Service - Linux (core)
• Suspicious Curl File Upload - Linux (core)
• Monero Crypto Coin Mining Pool Lookup (core)
• Network Connection Initiated To BTunnels Domains (core)
• Network Connection Initiated To Cloudflared Tunnels Domains (core)
• Communication To Ngrok Tunneling Service Initiated (core)
• Process Initiated Network Connection To Ngrok Domain (core)
• Suspicious Non-Browser Network Communication With Telegram API (core)
• Network Connection Initiated To Visual Studio Code Tunnels Domain (core)
• Arbitrary File Download Via ConfigSecurityPolicy.EXE (core)
• LOLBAS Data Exfiltration by DataSvcUtil.exe (core)

Elastic and Splunk rules

• Network Connection to OAST Domain via Script Interpreter (elastic)
• Potential Third-Party Cloud Storage Client Execution (elastic)
• Anthropic Organization Data Export Accessed (elastic)
• Anthropic Artifact Shared Publicly (elastic)
• Anthropic Excessive Chat Snapshot Creation (elastic)
• Anthropic High File Upload Activity (elastic)
• AWS DynamoDB Scan by Unusual User (elastic)
• AWS DynamoDB Table Exported to S3 (elastic)
• AWS EC2 Export Task (elastic)
• AWS RDS Snapshot Export (elastic)
• AWS S3 Bucket Replicated to Another Account (elastic)
• AWS API Activity from Uncommon S3 Client by Rare User (elastic)
• AWS SNS Rare Protocol Subscription by User (elastic)
• AWS SNS Topic Message Publish by Rare User (elastic)
• Azure Storage Blob Retrieval via AzCopy (elastic)
• GitHub Webhook Created or Configuration Changed (elastic)
• GitHub Private Repository Turned Public (elastic)
• GitHub Exfiltration via High Number of Repository Clones by User (elastic)
• High Number of Closed Pull Requests by User (elastic)
• Several Failed Protected Branch Force Pushes by User (elastic)
• High Number of Protected Branch Force Pushes by User (elastic)
• M365 OneDrive/SharePoint Excessive File Downloads (elastic)
• OpenAI ChatGPT Enterprise Conversation Shared (elastic)
• OpenAI ChatGPT Enterprise Gmail Message Sent via Connector (elastic)
• OpenAI ChatGPT Enterprise Google Drive Download Burst (elastic)

Showing 25 of 49.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.