Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-WebhookAbuse-Exfiltration.
Upgrade to ProDetect Data Exfiltration via Abused Chat/Collaboration Webhooks in Elastic Security
Adversaries and commodity malware increasingly exfiltrate collected data by POSTing it directly to a webhook URL belonging to a legitimate chat/collaboration platform (Discord, Slack, Microsoft Teams, Telegram Bot API) rather than to attacker-registered infrastructure. Because the destination is a trusted, widely-used SaaS domain (discord.com, hooks.slack.com, api.telegram.org, webhook.office.com), traffic blends with normal business or personal use and is rarely blocked by domain-category web filtering. Commodity infostealers (RedLine, Raccoon, and numerous Discord-webhook-based stealer builders sold on criminal forums) hardcode a webhook URL and POST harvested browser credentials, cookies, and system information as a JSON body immediately after collection. This differs from the HTTP-header-smuggling pattern already in this corpus (which hides data in header fields to evade body inspection) and from the cloud-storage rclone/AzCopy pattern (which uses dedicated sync tooling) by keying on two distinct signals: (1) an outbound POST request to a known webhook endpoint pattern (discord.com/api/webhooks/, hooks.slack.com/services/, api.telegram.org/bot) originating from a process that is not the platform's own client application, and (2) a JSON request body of unusual size or containing high-entropy/Base64-encoded content, since legitimate webhook integrations (CI/CD notifications, monitoring alerts) post small, low-entropy structured payloads.
MITRE ATT&CK
- Tactic
- Exfiltration
Elastic Detection Query
network where event.type == "start" and
(
(destination.domain : ("*discord.com", "*discordapp.com") and url.path : "*/api/webhooks/*")
or (destination.domain : "hooks.slack.com" and url.path : "*/services/*")
or (destination.domain : "api.telegram.org" and url.path : "*/bot*")
) and not process.name : ("Teams.exe", "Slack.exe", "Discord.exe")Detects webhook-based exfiltration using Elastic ECS network events, matching outbound connections to Discord, Slack, or Telegram Bot API webhook URL patterns that do not originate from the platform's own client process.
Data Sources
Required Tables
False Positives & Tuning
- CI/CD pipeline agents posting build notifications to a Slack or Teams incoming webhook
- Approved monitoring integrations posting alerts to Discord/Slack webhooks
- Custom internal automation scripts relaying events to a webhook with IT approval
Other platforms for THREAT-WebhookAbuse-Exfiltration
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Exfiltration of Collected Data via Webhook-Style POST
Expected signal: Sysmon Event ID 1: powershell.exe with ConvertTo-Json/FromBase64String-style command line. Sysmon Event ID 3: powershell.exe connecting to 127.0.0.1:8080 with a URI path matching /api/webhooks/. Proxy/packet capture (if present) shows a JSON POST body.
- Test 2Linux curl Chunked Exfiltration via Simulated Slack Incoming Webhook
Expected signal: auditd/Sysmon-for-Linux: execve records for curl and connect() calls to 127.0.0.1:8080 at ~1-second intervals, six POSTs with a URI path matching /services/.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-WebhookAbuse-Exfiltration — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.