Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-WebhookAbuse-Exfiltration.
Upgrade to ProDetect Data Exfiltration via Abused Chat/Collaboration Webhooks in Sumo Logic CSE
Adversaries and commodity malware increasingly exfiltrate collected data by POSTing it directly to a webhook URL belonging to a legitimate chat/collaboration platform (Discord, Slack, Microsoft Teams, Telegram Bot API) rather than to attacker-registered infrastructure. Because the destination is a trusted, widely-used SaaS domain (discord.com, hooks.slack.com, api.telegram.org, webhook.office.com), traffic blends with normal business or personal use and is rarely blocked by domain-category web filtering. Commodity infostealers (RedLine, Raccoon, and numerous Discord-webhook-based stealer builders sold on criminal forums) hardcode a webhook URL and POST harvested browser credentials, cookies, and system information as a JSON body immediately after collection. This differs from the HTTP-header-smuggling pattern already in this corpus (which hides data in header fields to evade body inspection) and from the cloud-storage rclone/AzCopy pattern (which uses dedicated sync tooling) by keying on two distinct signals: (1) an outbound POST request to a known webhook endpoint pattern (discord.com/api/webhooks/, hooks.slack.com/services/, api.telegram.org/bot) originating from a process that is not the platform's own client application, and (2) a JSON request body of unusual size or containing high-entropy/Base64-encoded content, since legitimate webhook integrations (CI/CD notifications, monitoring alerts) post small, low-entropy structured payloads.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
_sourceCategory=*proxy* OR _sourceCategory=*sysmon*
| where (url matches "*discord.com/api/webhooks*" or url matches "*hooks.slack.com/services*" or url matches "*api.telegram.org/bot*")
| where !(Image matches "*Teams.exe" or Image matches "*Slack.exe" or Image matches "*Discord.exe")
| stats count as PostCount, values(url) as WebhookUrls by ComputerName, User, Image
| where PostCount > 3
| sort - PostCountSumo Logic search surfacing hosts/processes posting to known webhook URL patterns without being the platform's recognised client, aggregated by host and process to expose repeated abuse.
Data Sources
Required Tables
False Positives & Tuning
- CI/CD notification integrations posting to Slack/Teams webhooks
- Approved monitoring tools posting to Discord/Slack webhooks
Other platforms for THREAT-WebhookAbuse-Exfiltration
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Exfiltration of Collected Data via Webhook-Style POST
Expected signal: Sysmon Event ID 1: powershell.exe with ConvertTo-Json/FromBase64String-style command line. Sysmon Event ID 3: powershell.exe connecting to 127.0.0.1:8080 with a URI path matching /api/webhooks/. Proxy/packet capture (if present) shows a JSON POST body.
- Test 2Linux curl Chunked Exfiltration via Simulated Slack Incoming Webhook
Expected signal: auditd/Sysmon-for-Linux: execve records for curl and connect() calls to 127.0.0.1:8080 at ~1-second intervals, six POSTs with a URI path matching /services/.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-WebhookAbuse-Exfiltration — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.