Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-PasteSite-TextStorageExfil.
Upgrade to ProDetect Data Exfiltration to Public Paste and Text-Storage Sites in Google Chronicle
Public paste and text-storage sites — Pastebin, Ghostbin, Rentry, Hastebin, dpaste, paste.ee, and similar services — let anyone post arbitrary text via a simple HTTPS POST with no authentication and no account required. Unlike code-repository exfiltration (T1567.001, e.g. GitHub Gist, which requires an account and leaves attributable commit metadata) or cloud-storage exfiltration (T1567.002, e.g. S3/Azure Blob, which requires provisioned storage and credentials), paste sites are frictionless: an adversary drops one HTTP request and the data is live at a public URL within seconds. Web-filtering categorization rarely blocks them (most proxies bucket paste sites under 'technology' or 'reference', not 'file sharing' or 'uploads'), and the destination is TLS-encrypted, so DLP tooling that inspects only unencrypted egress or that keys off file-sharing categories misses it entirely. This makes paste sites a favorite low-effort channel for two distinct actor classes: commodity infostealers (RedLine, Vidar, LummaC2 builders have shipped configurations that POST harvested credential/cookie logs directly to Pastebin's API endpoint) and extortion/data-leak operators (LAPSUS$ and similar groups have posted proof-of-compromise source-code snippets and credential dumps to paste sites as pre-ransom leverage before standing up a dedicated leak site). The detection signal is a non-browser process — a script interpreter, a compiled malware binary, or an automation tool that has no legitimate reason to post to a paste service — issuing an HTTPS connection to a paste-site domain, particularly one immediately following bulk file or credential-store access.
MITRE ATT&CK
- Tactic
- Exfiltration
YARA-L Detection Query
rule paste_site_non_browser_exfiltration {
meta:
author = "Detection Engineering"
description = "Detects a non-browser process establishing an outbound HTTP(S) connection to a known paste/text-storage site, consistent with infostealer or leak-actor data exfiltration."
mitre_attack_tactic = "Exfiltration"
mitre_attack_technique = "T1567.003"
severity = "HIGH"
priority = "HIGH"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.target.url = /pastebin\.com|paste\.ee|ghostbin\.com|rentry\.co|hastebin\.com|dpaste\.(org|com)/ nocase
$e.principal.process.file.full_path != /chrome\.exe|msedge\.exe|firefox\.exe|brave\.exe|opera\.exe/ nocase
$proc = $e.principal.process.file.full_path
$url = $e.target.url
match:
$proc, $url over 1h
outcome:
$connection_count = count($e.metadata.id)
condition:
$e and $connection_count >= 1
}Chronicle YARA-L 2.0 rule matching NETWORK_HTTP UDM events where target.url resolves to a known paste-site domain from a process outside the known browser allowlist.
Data Sources
Required Tables
False Positives & Tuning
- Developers or researchers legitimately sharing code/config snippets via a CLI tool rather than a browser
- CI/CD pipelines uploading build logs to an approved paste service
- Leaked-credential monitoring tools issuing read-only GET requests to paste sites
Other platforms for THREAT-PasteSite-TextStorageExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Non-Browser POST to a Paste-Site-Style Endpoint
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents: powershell.exe connecting to 127.0.0.1:8443 with a RemoteUrl resembling a paste-API path. If a local test listener is running, its logs will show the POST body containing the synthetic credential payload.
- Test 2Repeated Paste-Style Connections from a Temp-Directory Binary
Expected signal: Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_paste_test\. Sysmon Event ID 3: three network connection events to the test endpoint spaced ~5 seconds apart, initiated by the temp-directory binary.
- Test 3Bulk File Staging Followed by Paste-Style Post
Expected signal: Process creation for tar and curl; a network connection event (Sysmon-for-Linux Event ID 3 / auditd network record) from curl to the test endpoint within seconds of the archive being written to /tmp.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-PasteSite-TextStorageExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.