Cross-source coverage
T1567.001 / ATT&CK
Exfiltration Over Web Service: Exfiltration to Code Repository
10 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
- Tactics
- Exfiltration
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:EXECVEauditd:SYSCALLNSM:Flowmacos:unifiedlogesxi:hostdesxi:vmkernel
How MITRE says to detect it DET0318
Detection Strategy for Exfiltration to Code Repository
Windows Analytic 0895
Processes such as PowerShell, Git, or curl initiating outbound HTTPS POST requests to known code repository APIs (e.g., github.com, gitlab.com) immediately following large file reads. Defender view: correlation between file access of sensitive directories (e.g., Documents, Finance) and abnormal data uploads to repository domains.
WinEventLog:SecurityEventCode=4663, 4670, 4656WinEventLog:SysmonEventCode=3, 22WinEventLog:SysmonEventCode=1
Linux Analytic 0896
Processes like git, curl, or python scripts executing commands that package files (tar, gzip) followed by HTTPS uploads to code repository endpoints. Defender view: detect unusual git push activity or scripted HTTPS requests outside normal developer work hours.
auditd:EXECVEgit push, curl -X POSTauditd:SYSCALLopen/read of sensitive directoriesNSM:Flowlarge outbound HTTPS uploads to repo domains
macOS Analytic 0897
Office or scripting applications initiating unusual HTTPS traffic to code repository APIs with high outbound-to-inbound ratios. Defender perspective: monitor for sensitive file access in combination with network connections to github.com, gitlab.com, or bitbucket.org.
macos:unifiedlogexecution of curl, git, or Office processes with network connectionsmacos:unifiedlogread of user document directoriesmacos:unifiedlogoutbound HTTPS connections to code repository APIs
ESXi Analytic 0898
ESXi host processes (vmx, hostd) initiating HTTPS sessions toward external code repositories. Defender perspective: detect datastore reads followed by outbound web traffic inconsistent with administrative baselines.
esxi:hostddatastore file accessesxi:vmkernelHTTPS traffic to repository domains
elastic/detection-rules
8 rules| Detection | Severity | Format |
|---|---|---|
| GitHub Exfiltration via High Number of Repository Clones by User | Medium | Elastic TOML |
| High Number of Closed Pull Requests by User | Medium | Elastic TOML |
| High Number of Protected Branch Force Pushes by User | Medium | Elastic TOML |
| Potential PowerShell HackTool Script by Function Names | Medium | Elastic TOML |
| Several Failed Protected Branch Force Pushes by User | Medium | Elastic TOML |
| Connection to Commonly Abused Web Services | Low | Elastic TOML |
| DNS Request to Suspicious Top Level Domain | Low | Elastic TOML |
| GitHub Private Repository Turned Public | Low | Elastic TOML |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Network Connection Initiated To DevTunnels Domain | Medium | Sigma |
| GitHub Repository Pages Site Changed to Public | Low | Sigma |