Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-PasteSite-TextStorageExfil.
Upgrade to ProDetect Data Exfiltration to Public Paste and Text-Storage Sites in IBM QRadar
Public paste and text-storage sites — Pastebin, Ghostbin, Rentry, Hastebin, dpaste, paste.ee, and similar services — let anyone post arbitrary text via a simple HTTPS POST with no authentication and no account required. Unlike code-repository exfiltration (T1567.001, e.g. GitHub Gist, which requires an account and leaves attributable commit metadata) or cloud-storage exfiltration (T1567.002, e.g. S3/Azure Blob, which requires provisioned storage and credentials), paste sites are frictionless: an adversary drops one HTTP request and the data is live at a public URL within seconds. Web-filtering categorization rarely blocks them (most proxies bucket paste sites under 'technology' or 'reference', not 'file sharing' or 'uploads'), and the destination is TLS-encrypted, so DLP tooling that inspects only unencrypted egress or that keys off file-sharing categories misses it entirely. This makes paste sites a favorite low-effort channel for two distinct actor classes: commodity infostealers (RedLine, Vidar, LummaC2 builders have shipped configurations that POST harvested credential/cookie logs directly to Pastebin's API endpoint) and extortion/data-leak operators (LAPSUS$ and similar groups have posted proof-of-compromise source-code snippets and credential dumps to paste sites as pre-ransom leverage before standing up a dedicated leak site). The detection signal is a non-browser process — a script interpreter, a compiled malware binary, or an automation tool that has no legitimate reason to post to a paste service — issuing an HTTPS connection to a paste-site domain, particularly one immediately following bulk file or credential-store access.
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
sourceip AS SourceIP,
"URL" AS RequestUrl,
"Application Name" AS ProcessName,
COUNT(*) AS ConnectionCount,
MIN(starttime) AS FirstSeen,
MAX(starttime) AS LastSeen
FROM events
WHERE
("URL" ILIKE '%pastebin.com%' OR "URL" ILIKE '%paste.ee%' OR "URL" ILIKE '%ghostbin.com%' OR "URL" ILIKE '%rentry.co%' OR "URL" ILIKE '%hastebin.com%' OR "URL" ILIKE '%dpaste.org%')
AND "Application Name" NOT IN ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe', 'opera.exe')
AND starttime > (NOW() - 86400000)
GROUP BY sourceip, "URL", "Application Name"
ORDER BY ConnectionCount DESCQRadar AQL query against the normalized events table (proxy/web DSM events carrying a URL custom property) for connections to known paste-site domains from any process other than a recognized browser, using ILIKE substring matching against the URL property.
Data Sources
Required Tables
False Positives & Tuning
- Developers or researchers legitimately sharing code/config snippets via a CLI tool rather than a browser
- CI/CD pipelines uploading build logs to an approved paste service
- Leaked-credential monitoring tools issuing read-only GET requests to paste sites
Other platforms for THREAT-PasteSite-TextStorageExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Non-Browser POST to a Paste-Site-Style Endpoint
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents: powershell.exe connecting to 127.0.0.1:8443 with a RemoteUrl resembling a paste-API path. If a local test listener is running, its logs will show the POST body containing the synthetic credential payload.
- Test 2Repeated Paste-Style Connections from a Temp-Directory Binary
Expected signal: Sysmon Event ID 1: update_helper.exe (a copy of powershell.exe) executing from %TEMP%\atomic_paste_test\. Sysmon Event ID 3: three network connection events to the test endpoint spaced ~5 seconds apart, initiated by the temp-directory binary.
- Test 3Bulk File Staging Followed by Paste-Style Post
Expected signal: Process creation for tar and curl; a network connection event (Sysmon-for-Linux Event ID 3 / auditd network record) from curl to the test endpoint within seconds of the archive being written to /tmp.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-PasteSite-TextStorageExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.