Cross-source coverage
T1567.004 / ATT&CK
Exfiltration Over Web Service: Exfiltration Over Webhook
1 rule across 1 source.
From MITRE ATT&CK 19.2
Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and webhook.site, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello. When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.
Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated Automated Exfiltration of emails, chat messages, and other data. Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.
Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.
- Tactics
- Exfiltration
- Platforms
- ESXi · Linux · macOS · Office Suite · SaaS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:Securityauditd:EXECVEauditd:SYSCALLNSM:Flowmacos:unifiedlogesxi:hostdesxi:vmkernelm365:unifiedsaas:api
How MITRE says to detect it DET0153
Detection Strategy for Exfiltration Over Webhook
Windows Analytic 0436
Unusual processes (e.g., powershell.exe, wscript.exe, mshta.exe) posting data to webhook endpoints (Discord, Slack, webhook.site) using HTTP POST/PUT requests. Defender perspective: suspicious process lineage followed by outbound HTTPS traffic to webhook domains.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=3, 22WinEventLog:SecurityEventCode=4663, 4670, 4656
Linux Analytic 0437
Processes such as curl, wget, or custom scripts initiating POST requests to webhook endpoints with encoded or bulk data. Defender perspective: abnormal chaining of file compression or access followed by outbound data to webhook URLs.
auditd:EXECVEcurl -X POST, wget --post-dataauditd:SYSCALLread/open of sensitive filesNSM:Flowlarge HTTPS POST requests to webhook endpoints
macOS Analytic 0438
Unexpected apps or scripts (osascript, curl, Automator workflows) exfiltrating data via webhooks. Defender perspective: correlation of clipboard/file read operations followed by HTTPS POST traffic to webhook services.
macos:unifiedlogexecution of osascript, curl, or unexpected automationmacos:unifiedlogfile read of sensitive directoriesmacos:unifiedlogHTTPS POST to known webhook URLs
ESXi Analytic 0439
VMware services or management daemons generating HTTP POST requests to webhook endpoints, chained with unusual datastore or log access. Defender perspective: exfiltration from VM logs or disk images over webhook URLs.
esxi:hostddatastore file accessesxi:vmkernelHTTPS POST connections to webhook endpoints
SaaS Analytic 0440
Suspicious SaaS tenant activity involving webhook configurations pointing to external or untrusted domains. Defender perspective: repeated automated exports or suspicious webhook endpoint registrations.
m365:unifiedSet-Mailbox, Add-InboxRule, RegisterWebhooksaas:apiWebhook registrations or repeated POST activity
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Unusual Network Connection to Suspicious Web Service | Medium | Elastic TOML |