Detect Exfiltration to Code Repository in Sumo Logic CSE
Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network. Tools such as Empire have been observed using GitHub for data exfiltration, leveraging the GitHub API to stage and retrieve data as part of a C2 channel.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1567 Exfiltration Over Web Service
- Sub-technique
- T1567.001 Exfiltration to Code Repository
- Canonical reference
- https://attack.mitre.org/techniques/T1567/001/
Sumo Detection Query
// Signal 1: Network connections to code repo domains (Sysmon Event 3)
(_sourceCategory="windows/sysmon" OR _sourceCategory="siem/windows/sysmon")
| parse "EventID>*<" as EventID nodrop
| parse "DestinationHostname>*<" as DestinationHostname nodrop
| parse "Image>*<" as Image nodrop
| parse "User>*<" as User nodrop
| parse "Computer>*<" as Computer nodrop
| where EventID = "3"
| where DestinationHostname matches "*github.com*"
OR DestinationHostname matches "*gitlab.com*"
OR DestinationHostname matches "*bitbucket.org*"
OR DestinationHostname matches "*dev.azure.com*"
OR DestinationHostname matches "*codeberg.org*"
OR DestinationHostname matches "*gist.github.com*"
| where Image matches "*\\git.exe" OR Image matches "*\\curl.exe"
OR Image matches "*\\wget.exe" OR Image matches "*\\python.exe"
OR Image matches "*\\python3.exe" OR Image matches "*\\powershell.exe"
OR Image matches "*\\pwsh.exe" OR Image matches "*\\node.exe"
OR Image matches "*\\ruby.exe"
| eval Signal = "NetworkConnectionToCodeRepo"
// Signal 2: Git push to external repos (Sysmon Event 1)
| union [
(_sourceCategory="windows/sysmon" OR _sourceCategory="siem/windows/sysmon")
| parse "EventID>*<" as EventID nodrop
| parse "Image>*<" as Image nodrop
| parse "CommandLine>*<" as CommandLine nodrop
| parse "ParentImage>*<" as ParentImage nodrop
| parse "User>*<" as User nodrop
| parse "Computer>*<" as Computer nodrop
| where EventID = "1"
| where Image matches "*\\git.exe"
| where CommandLine matches "*push*"
| where CommandLine matches "*github.com*"
OR CommandLine matches "*gitlab.com*"
OR CommandLine matches "*bitbucket.org*"
OR CommandLine matches "*dev.azure.com*"
| eval Signal = "GitPushToExternalRepo"
]
// Signal 3: REST API file uploads (Sysmon Event 1)
| union [
(_sourceCategory="windows/sysmon" OR _sourceCategory="siem/windows/sysmon")
| parse "EventID>*<" as EventID nodrop
| parse "Image>*<" as Image nodrop
| parse "CommandLine>*<" as CommandLine nodrop
| parse "ParentImage>*<" as ParentImage nodrop
| parse "User>*<" as User nodrop
| parse "Computer>*<" as Computer nodrop
| where EventID = "1"
| where Image matches "*\\curl.exe" OR Image matches "*\\wget.exe"
OR Image matches "*\\python.exe" OR Image matches "*\\python3.exe"
OR Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe"
OR Image matches "*\\node.exe" OR Image matches "*\\ruby.exe"
| where (CommandLine matches "*api.github.com*"
OR CommandLine matches "*api.gitlab.com*"
OR CommandLine matches "*gist.github.com*")
| where (CommandLine matches "*-X PUT*" OR CommandLine matches "*-X POST*"
OR CommandLine matches "*contents*" OR CommandLine matches "*gists*"
OR CommandLine matches "*Invoke-RestMethod*" OR CommandLine matches "*requests.put*"
OR CommandLine matches "*requests.post*" OR CommandLine matches "*upload*")
| eval Signal = "CodeRepoAPIUpload"
]
// Scoring and filtering
| eval IsCISystem = if (Computer matches "(?i)jenkins|gitlab-runner|ci[-_]|build[-_]|deploy|devops|runner|bamboo|teamcity", 1, 0)
| eval IsKnownIDE = if (ParentImage matches "(?i)code\\.exe|idea64\\.exe|pycharm|devenv\\.exe|sourcetree|gitkraken|fork\\.exe|tower\\.exe", 1, 0)
| eval SuspicionScore = if (Signal = "GitPushToExternalRepo" AND IsCISystem = 0, 3,
if (Signal = "CodeRepoAPIUpload" AND IsCISystem = 0, 3,
if (Signal = "NetworkConnectionToCodeRepo" AND IsCISystem = 0 AND IsKnownIDE = 0, 2,
if (Signal = "NetworkConnectionToCodeRepo" AND IsCISystem = 0 AND IsKnownIDE = 1, 1, 0))))
| where SuspicionScore >= 2
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, DestinationHostname, Signal, IsCISystem, IsKnownIDE, SuspicionScore
| sort by SuspicionScore desc, _messageTime descSumo Logic query detecting T1567.001 exfiltration to code repositories using Sysmon event data. Combines three detection signals: Sysmon Event 3 (network connections to code hosting platforms from scripting tools), Sysmon Event 1 (git push commands targeting external repos), and Sysmon Event 1 (REST API uploads via PUT/POST methods). Applies CI/CD and IDE context scoring to reduce false positives, surfacing alerts with suspicion score >= 2.
Data Sources
Required Tables
False Positives & Tuning
- CI/CD build agents (Jenkins, GitHub Actions self-hosted runners, GitLab Runner, TeamCity agents) running on endpoints will generate frequent git push and API upload activity as part of normal pipeline execution — these are excluded by the IsCISystem filter but custom-named systems may bypass it
- Developers using GUI git clients (SourceTree, GitKraken, Fork, Tower) that invoke git.exe or curl.exe as subprocesses when pushing large repositories — IsKnownIDE detection mitigates this but reduces score rather than eliminating the alert
- Automated open-source contribution bots or security tools that submit vulnerability disclosures, SARIF reports, or dependency updates to public repositories via the GitHub/GitLab API using PUT/POST HTTP methods
Other platforms for T1567.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Exfiltrate Data via GitHub Contents API Using PowerShell
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'api.github.com', 'Invoke-RestMethod', 'PUT', and 'token'. Sysmon Event ID 3: Network Connection from powershell.exe to api.github.com:443. PowerShell ScriptBlock Log Event ID 4104 with full API request including the encoded content. Network proxy logs show HTTPS PUT to api.github.com with outbound payload.
- Test 2Git Push Sensitive Files to External Repository from Command Shell
Expected signal: Sysmon Event ID 1: Multiple process creates — cmd.exe, git.exe (init), git.exe (add), git.exe (commit), git.exe (push) with CommandLine containing 'github.com' and '--force'. Sysmon Event ID 3: Network Connection from git.exe to github.com:443. Sysmon Event ID 11: File Create for stolen_creds.txt in %TEMP%\df00tech-exfil. Security Event ID 4688 if command line auditing enabled.
- Test 3Exfiltrate Data via GitHub Gist API Using curl
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe spawning curl.exe, CommandLine containing 'api.github.com/gists', '-X POST', and the Authorization header with PAT. Sysmon Event ID 3: Network Connection from curl.exe to api.github.com:443. Proxy logs show HTTPS POST to api.github.com/gists with outbound JSON payload.
- Test 4Automated Data Exfiltration via Python GitHub API Script
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe and CommandLine containing 'api.github.com', 'PUT', 'urllib.request', and the Authorization token. Sysmon Event ID 3: Network Connection from python.exe to api.github.com:443. No PowerShell ScriptBlock logging (Python process); look for Python audit hooks or endpoint DLP alerts on the data access pattern (reading hosts file).
References (10)
- https://attack.mitre.org/techniques/T1567/001/
- https://github.com/EmpireProject/Empire
- https://docs.github.com/en/rest/repos/contents
- https://docs.github.com/en/rest/gists/gists
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1567.001/T1567.001.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Unlock Pro Content
Get the full detection package for T1567.001 including response playbook, investigation guide, and atomic red team tests.