Cross-source coverage

T1567.003 / ATT&CK

Exfiltration Over Web Service: Exfiltration to Text Storage Sites

3 rules across 1 source.

From MITRE ATT&CK 19.2

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.

Text storage sites are often used to host malicious code for C2 communication (e.g., Stage Capabilities), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.

Note: This is distinct from Exfiltration to Code Repository, which highlight access to code repositories via APIs.

Tactics: Exfiltration
Platforms: Linux · macOS · Windows · ESXi
Telemetry: WinEventLog:SecurityWinEventLog:Sysmonauditd:EXECVEauditd:SYSCALLNSM:Flowmacos:unifiedlogesxi:hostdesxi:vmkernel

How MITRE says to detect it DET0284

Detection Strategy for Exfiltration to Text Storage Sites

Windows Analytic 0787

Unexpected processes (e.g., powershell.exe, wscript.exe, office apps) initiating HTTP POST/PUT requests to text storage domains like pastebin.com or hastebin.com, particularly when preceded by file access in sensitive directories. Defender perspective: correlation of process lineage, large clipboard/file read operations, and outbound uploads to text storage services.

WinEventLog:Security EventCode=4663, 4670, 4656
WinEventLog:Sysmon EventCode=3, 22
WinEventLog:Sysmon EventCode=1

Linux Analytic 0788

Use of curl, wget, or custom scripts to POST data to pastebin-like services. Defender perspective: identify chained behavior where files are compressed/read followed by HTTPS POST requests to text-sharing endpoints.

auditd:EXECVE curl -d, wget --post-data
auditd:SYSCALL read/open of sensitive file directories
NSM:Flow large HTTPS POST requests to text storage domains

macOS Analytic 0789

Processes such as osascript, curl, or office applications sending data to text storage APIs/domains. Defender perspective: anomalous clipboard or file reads by unexpected applications immediately followed by outbound HTTPS requests to pastebin-like services.

macos:unifiedlog execution of curl, osascript, or unexpected Office processes
macos:unifiedlog file read of sensitive directories
macos:unifiedlog HTTPS POST requests to pastebin.com or similar

ESXi Analytic 0790

ESXi services (vmx, hostd) generating outbound HTTPS POST requests to text storage sites. Defender perspective: anomalous datastore or log reads chained with traffic to pastebin-like destinations.

esxi:hostd datastore/log file access
esxi:vmkernel HTTPS POST connections to pastebin-like domains

View on attack.mitre.org ↗

elastic/detection-rules

3 rules

Detection	Severity	Format
Unusual Network Connection to Suspicious Web Service	Medium	Elastic TOML
Connection to Commonly Abused Web Services	Low	Elastic TOML
DNS Request to Suspicious Top Level Domain	Low	Elastic TOML