T1567

Exfiltration Over Web Service

Exfiltration

Adversaries may use an existing, legitimate external web service to exfiltrate data rather than their primary command and control channel. Popular web services acting as an exfiltration mechanism may give significant cover because hosts within a network are likely already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Observed real-world abuse includes exfiltration to Telegram (Magic Hound, Contagious Interview), cloud storage (APT28 to Google Drive, Exbyte/BlackByte to Mega.co.nz), code repositories, file-sharing services (anonymfiles.com, file.io), and Microsoft Exchange Web Services (OilCheck, SampleCheck5000).

Microsoft Sentinel / Defender
kusto 
let KnownExfilDomains = dynamic([
  "api.telegram.org",
  "discord.com",
  "discordapp.com",
  "mega.co.nz",
  "mega.nz",
  "file.io",
  "transfer.sh",
  "gofile.io",
  "anonymfiles.com",
  "anonfiles.com",
  "ufile.io",
  "pixeldrain.com",
  "paste.ee",
  "pastebin.com",
  "hastebin.com",
  "rentry.co",
  "ghostbin.com",
  "privatbin.net",
  "ngrok.io",
  "ngrok-free.app",
  "serveo.net"
]);
let CloudStorageDomains = dynamic([
  "content.dropboxapi.com",
  "api.dropboxapi.com",
  "www.googleapis.com",
  "drive.google.com",
  "graph.microsoft.com",
  "onedrive.live.com",
  "api.github.com",
  "gitlab.com",
  "bitbucket.org",
  "s3.amazonaws.com",
  "storage.googleapis.com"
]);
let SuspiciousUploadProcesses = dynamic([
  "curl.exe", "curl", "wget", "wget.exe",
  "powershell.exe", "pwsh.exe",
  "python.exe", "python3", "python3.exe",
  "node.exe", "node",
  "wscript.exe", "cscript.exe",
  "certutil.exe", "bitsadmin.exe"
]);
// Branch 1: Direct connections to known file-sharing / messaging exfil services
let DirectExfilConnections = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
| where RemoteUrl has_any (KnownExfilDomains) or RemoteIPType == "Public"
| where RemoteUrl has_any (KnownExfilDomains)
| extend ExfilCategory = case(
    RemoteUrl has_any ("telegram"), "Messaging API",
    RemoteUrl has_any ("discord"), "Messaging API",
    RemoteUrl has_any ("mega", "file.io", "transfer.sh", "gofile", "anonymfiles", "anonfiles", "ufile", "pixeldrain"), "File Sharing",
    RemoteUrl has_any ("pastebin", "hastebin", "rentry", "ghostbin", "paste.ee", "privatbin"), "Paste Site",
    RemoteUrl has_any ("ngrok", "serveo"), "Tunnel Service",
    "Other"
  )
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName,
         RemoteUrl, RemoteIP, RemotePort, BytesSent, BytesReceived,
         ExfilCategory;
// Branch 2: High-volume uploads to cloud storage from unusual processes
let CloudStorageHighVolume = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
| where RemoteUrl has_any (CloudStorageDomains)
| where InitiatingProcessFileName in~ (SuspiciousUploadProcesses)
| where BytesSent > 1048576 // > 1MB upload
| extend ExfilCategory = "Cloud Storage Upload"
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName,
         RemoteUrl, RemoteIP, RemotePort, BytesSent, BytesReceived,
         ExfilCategory;
// Branch 3: Aggregate large data sent to any single public IP from scripting engines
let AggregatedExfilAttempts = DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| where InitiatingProcessFileName in~ (SuspiciousUploadProcesses)
| summarize TotalBytesSent=sum(BytesSent), TotalBytesReceived=sum(BytesReceived),
            ConnectionCount=count(), UniqueRemoteIPs=dcount(RemoteIP)
            by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 1h)
| where TotalBytesSent > 10485760 // > 10MB total in 1 hour
| extend ExfilCategory = "Bulk Upload Detected"
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         TotalBytesSent, TotalBytesReceived, ConnectionCount, UniqueRemoteIPs,
         ExfilCategory;
union DirectExfilConnections, CloudStorageHighVolume
| union (AggregatedExfilAttempts | extend RemoteUrl="", RemoteIP="", RemotePort=0, BytesSent=TotalBytesSent, BytesReceived=TotalBytesReceived)
| sort by Timestamp desc
high severity medium confidence

Data Sources

Network Traffic: Network Connection Creation Network Traffic: Network Traffic Flow Microsoft Defender for Endpoint

Required Tables

DeviceNetworkEvents

False Positives

  • Developers legitimately pushing code to GitHub, GitLab, or Bitbucket from workstations — especially large repositories or LFS objects
  • IT automation scripts (SCCM, Intune, Ansible) uploading diagnostics or configuration files to cloud storage like OneDrive or S3
  • Employees using Telegram, Discord, or Slack Desktop apps to share work files — the initiating process may be a browser or Electron app
  • Backup agents uploading to cloud storage providers (Dropbox, OneDrive, Google Drive sync clients) which generate continuous high-volume traffic
  • Security tools or monitoring agents sending telemetry to SaaS platforms with large payloads
Last updated: 2026-04-21 Research depth: deep
References (10)

Unlock Pro Content

Get the full detection package for T1567 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (4)

Same Tactic: Exfiltration

Popular Detections