ShinyHuntersG1057 ↗
Has used compromised Salesforce CRM (Customer Relationship Management) dashboards to exfiltrate bulk data. Additionally, ShinyHunters has used LimeWire, a file-sharing service, to showcase samples of stolen data.1
tfMITRE ATT&CK technique
Exfiltration Over Web Service T1567
- Tactic
- Exfiltration
- Platforms
- ESXi, Linux, macOS, Office Suite, SaaS, Windows
- Version
- 1.5
- Created
- 09 March 2020
- Last modified
- 12 May 2026
- Contributor
- William Cain
Sub-techniques 444 rules across the family · 22 mapped directly to T1567 · 2 of 4 carry rules
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.4
CampaignsTop 10%
Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.7
Tools & malware71st pct
Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.22
Detection rulesTop 12%
Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.Exfiltration Over Web Service MITRE reference T1567
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Contagious InterviewG1052 ↗
Has leveraged Telegram API to exfiltrate stolen data.1
BlackByteG1043 ↗
Has used services such as anonymfiles.com and file.io to exfiltrate victim data.1
Magic HoundG0059 ↗
Has used the Telegram API sendMessage to relay data on compromised devices.1
APT28G0007 ↗
Can exfiltrate data over Google Drive.1
All 5 groups for this technique
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Anthropic AI-orchestrated CampaignC0062 ↗
During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to generate a detailed summary report of collected data, which is then reviewed and approved by the adversary prior to exfiltration of data over Claude.1
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 exfiltrated data over public-facing webservers – such as Google Drive.1
C0017C0017 ↗
During C0017, APT41 used Cloudflare services for data exfiltration.1
Salesforce Data ExfiltrationC0059 ↗
During Salesforce Data Exfiltration, threat actors exfiltrated data via legitimate Salesforce API communication channels including the Salesforce Data Loader application.12
All 4 campaigns for this technique
7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
InvisibleFerretS1245 ↗
Has leveraged Telegram chat to upload stolen data using the Telegram API with a bot token.12
ExbyteS1179 ↗
Exfiltrates collected data to online file hosting sites such as Mega.co.nz.12
OilCheckS1171 ↗
Can upload documents from compromised hosts to a shared Microsoft Office 365 Outlook email account for exfiltration.1
SampleCheck5000S1168 ↗
Can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve files for exfiltration.12
ngrokS0508 ↗
Has been used by threat actors to configure servers for data exfiltration.1
AppleSeedS0622 ↗
Has exfiltrated files using web services.1
All 7 software entries for this technique · 6 newest in this preview
Offense vs defense T1567
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 4Sigma rules (cumulative) · 12Splunk ESCU (cumulative) · 10
first rule: 2020 Q3 · 4 of 4 campaigns plottedExfiltration Over Web Service detection strategy DET0548
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Exfiltration Over Web Service
5 platforms
AN1511 · Windows
Processes that normally do not initiate network communications suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios. Defender view: correlation between process creation logs (e.g., Word, Excel, PowerShell) and subsequent anomalous network traffic volumes toward common web services (Dropbox, Google Drive, OneDrive).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredServices | List of legitimate web services to baseline (Dropbox, OneDrive, Google Drive). |
| ExfilVolumeThreshold | Outbound data threshold for flagging unusual activity, tunable by environment. |
| TimeWindow | Aggregation period to calculate anomalies in outbound data volume. |
AN1512 · Linux
Processes (tar, curl, python scripts) accessing large file sets and initiating outbound HTTPS POST requests with payload sizes inconsistent with baseline activity. Defender perspective: detect abnormal sequence of file archival followed by encrypted uploads to external web services.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | open/read of sensitive directories (/etc, /home/*) |
| Command ExecutionDC0064 | auditd:EXECVE | curl or wget with POST/PUT options |
| Network Traffic FlowDC0078 | NSM:Flow | sustained outbound HTTPS sessions with high data volume |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredTools | Suspicious command-line utilities used for exfiltration (curl, wget, python). |
| DataVolumeThreshold | Bytes transferred threshold per session to flag unusual uploads. |
AN1513 · macOS
Office apps or scripts writing files followed by xattr manipulation (to evade quarantine) and subsequent HTTPS uploads. Defender perspective: anomalous file modification + outbound TLS traffic originating from non-networking apps (Word, Excel, Preview).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | execution of Office binaries with network activity |
| File AccessDC0055 | macos:unifiedlog | read/write of user documents prior to upload |
| Network Traffic ContentDC0085 | macos:unifiedlog | outbound TLS connections to cloud storage providers |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedApplications | Applications not expected to perform bulk data transfers (Office apps, Preview). |
AN1514 · SaaS
Abnormal API calls from user accounts invoking file upload endpoints outside normal baselines (M365, Google Drive, Box). Defender perspective: monitor unified audit logs for elevated frequency of Upload, Create, or Copy operations from compromised accounts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | FileUploaded or FileCopied events |
| Network Traffic ContentDC0085 | saas:box | API calls exceeding baseline thresholds |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| APICallThreshold | Maximum number of API calls per user/session before triggering alert. |
| UserBaselineProfiles | Baseline normal data transfer patterns by user/role. |
AN1515 · ESXi
ESXi guest OS or management interface processes establishing unexpected external HTTPS connections. Defender perspective: monitor vmx or hostd processes making outbound web requests with significant data transfer.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | esxi:hostd | file copy or datastore upload via HTTPS |
| Network Connection CreationDC0082 | esxi:vmkernel | network session initiation with external HTTPS services |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DatastoreTransferThreshold | Threshold for outbound transfers from ESXi datastores. |
Data Loss PreventionM1057
Data loss prevention can be detect and block sensitive data being uploaded to web services via web browsers.
Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.