Data Exfiltration via Abused Chat/Collaboration Webhooks

let TimeWindow = 24h;
let WebhookDomains = dynamic(["discord.com", "discordapp.com", "hooks.slack.com", "api.telegram.org", "webhook.office.com", "outlook.office.com"]);
let LegitimateWebhookProcesses = dynamic(["teams.exe", "slack.exe", "discord.exe"]);
DeviceNetworkEvents
| where Timestamp > ago(TimeWindow)
| where ActionType =~ "ConnectionSuccess"
| where RemoteUrl has_any (WebhookDomains)
| where RemoteUrl has_any ("/api/webhooks/", "/services/", "/bot")
| where InitiatingProcessFileName !in~ (LegitimateWebhookProcesses)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, RemoteUrl, RemoteIP, SentBytes
| extend ThreatType = "Exfil_WebhookAbuse"
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(TimeWindow)
    | where ProcessCommandLine has_any ("webhooks", "hooks.slack", "api.telegram.org", "FromBase64String", "ConvertTo-Json")
    | project DeviceName, AccountName, ScriptIndicatorCmd = ProcessCommandLine, ScriptTimestamp = Timestamp
  ) on DeviceName, AccountName
| where isempty(ScriptIndicatorCmd) or datetime_diff('minute', Timestamp, ScriptTimestamp) between (-5 .. 5)
| summarize
    PostCount = count(),
    TotalBytesSent = sum(SentBytes),
    Processes = make_set(InitiatingProcessFileName),
    SampleCommandLine = any(ScriptIndicatorCmd),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
  by DeviceName, AccountName, RemoteUrl
| extend RiskScore = iff(PostCount > 5 or TotalBytesSent > 50000, 80, 60)
| sort by RiskScore desc, PostCount desc

index=proxy OR index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(
  DestinationHostname="*discord.com*" OR DestinationHostname="*discordapp.com*"
  OR DestinationHostname="*hooks.slack.com*" OR DestinationHostname="*api.telegram.org*"
  OR DestinationHostname="*webhook.office.com*"
)
NOT Image IN ("*\\Teams.exe", "*\\Slack.exe", "*\\Discord.exe")
| eval ThreatType="Exfil_WebhookAbuse"
| join type=left host, User
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (CommandLine="*webhooks*" OR CommandLine="*hooks.slack*" OR CommandLine="*api.telegram.org*" OR CommandLine="*FromBase64String*")
    | rename CommandLine AS ScriptIndicatorCmd, _time AS ScriptTime
    | table host, User, ScriptIndicatorCmd, ScriptTime ]
| stats count AS PostCount, values(ScriptIndicatorCmd) AS ScriptIndicators, earliest(_time) AS FirstSeen, latest(_time) AS LastSeen
  BY host, User, DestinationHostname, Image
| eval RiskScore=if(PostCount > 5, 80, 60)
| sort - RiskScore, - PostCount

network where event.type == "start" and
(
  (destination.domain : ("*discord.com", "*discordapp.com") and url.path : "*/api/webhooks/*")
  or (destination.domain : "hooks.slack.com" and url.path : "*/services/*")
  or (destination.domain : "api.telegram.org" and url.path : "*/bot*")
) and not process.name : ("Teams.exe", "Slack.exe", "Discord.exe")

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "URL" AS RequestUrl,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType
FROM events
WHERE
    (
        LOWER("URL") LIKE '%discord.com/api/webhooks%'
        OR LOWER("URL") LIKE '%discordapp.com/api/webhooks%'
        OR LOWER("URL") LIKE '%hooks.slack.com/services%'
        OR LOWER("URL") LIKE '%api.telegram.org/bot%'
    )
    AND LOWER("Process Name") NOT IN ('teams.exe', 'slack.exe', 'discord.exe')
    AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=*proxy* OR _sourceCategory=*sysmon*
| where (url matches "*discord.com/api/webhooks*" or url matches "*hooks.slack.com/services*" or url matches "*api.telegram.org/bot*")
| where !(Image matches "*Teams.exe" or Image matches "*Slack.exe" or Image matches "*Discord.exe")
| stats count as PostCount, values(url) as WebhookUrls by ComputerName, User, Image
| where PostCount > 3
| sort - PostCount

rule webhook_abuse_data_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects data exfiltration via abused chat/collaboration webhooks (Discord, Slack, Telegram)"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1567.004"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.target.url, `(?i)(discord(app)?\.com/api/webhooks|hooks\.slack\.com/services|api\.telegram\.org/bot)`)
    not re.regex($e.principal.process.file.full_path, `(?i)(teams|slack|discord)\.exe`)

  condition:
    $e
}

#event_simpleName=HttpRequest
| Url=/(?i)(discord(app)?\.com\/api\/webhooks|hooks\.slack\.com\/services|api\.telegram\.org\/bot)/
| ImageFileName!=/(?i)(teams|slack|discord)\.exe$/
| groupBy([ComputerName, UserName, ImageFileName, Url], function=[count(as=PostCount)])
| test(PostCount > 3)