Mini Shai-HuludS9043 ↗
Has exfiltrated data through the use of the victim’s own GitHub repository by creating a new public repository using a unique naming convention from a curated list of key words or themes.1234
tfMITRE ATT&CK sub-technique
Exfiltration to Code Repository T1567.001
sub-technique of T1567 Exfiltration Over Web Service
- Tactic
- Exfiltration
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.2
- Created
- 09 March 2020
- Last modified
- 12 May 2026
Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Exfiltration to Code Repository MITRE reference T1567.001
62nd pctamong all ATT&CK techniques for number of tools
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
Can create a repository in the victim's GitHub account using the victim's own GITHUB_TOKEN to upload stolen credentials.123456
Shai-HuludS9008 ↗
Has created a repository named Shai-Hulud under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets.123 Shai-Hulud has also posted stolen credentials to public GitHub repositories.4567
EmpireS0363 ↗
Can use GitHub for data exfiltration.1
All 4 software entries for this technique
Offense vs defense T1567.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0
first rule: 2023 Q4Exfiltration to Code Repository detection strategy DET0318
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Exfiltration to Code Repository
4 platforms
AN0895 · Windows
Processes such as PowerShell, Git, or curl initiating outbound HTTPS POST requests to known code repository APIs (e.g., github.com, gitlab.com) immediately following large file reads. Defender view: correlation between file access of sensitive directories (e.g., Documents, Finance) and abnormal data uploads to repository domains.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredDomains | List of external code repository domains to monitor (github.com, gitlab.com, bitbucket.org). |
| ExfilVolumeThreshold | Threshold for outbound data volume per session to flag suspicious uploads. |
AN0896 · Linux
Processes like git, curl, or python scripts executing commands that package files (tar, gzip) followed by HTTPS uploads to code repository endpoints. Defender view: detect unusual git push activity or scripted HTTPS requests outside normal developer work hours.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | open/read of sensitive directories |
| Command ExecutionDC0064 | auditd:EXECVE | git push, curl -X POST |
| Network Traffic FlowDC0078 | NSM:Flow | large outbound HTTPS uploads to repo domains |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WorkHours | Baseline normal developer activity periods to reduce false positives. |
| RepoDomainList | Known allowed internal or external repository domains. |
AN0897 · macOS
Office or scripting applications initiating unusual HTTPS traffic to code repository APIs with high outbound-to-inbound ratios. Defender perspective: monitor for sensitive file access in combination with network connections to github.com, gitlab.com, or bitbucket.org.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | execution of curl, git, or Office processes with network connections |
| File AccessDC0055 | macos:unifiedlog | read of user document directories |
| Network Traffic ContentDC0085 | macos:unifiedlog | outbound HTTPS connections to code repository APIs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredApplications | Applications not expected to upload large data sets to repos (Word, Excel, Preview). |
AN0898 · ESXi
ESXi host processes (vmx, hostd) initiating HTTPS sessions toward external code repositories. Defender perspective: detect datastore reads followed by outbound web traffic inconsistent with administrative baselines.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | esxi:hostd | datastore file access |
| Network Traffic FlowDC0078 | esxi:vmkernel | HTTPS traffic to repository domains |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DatastoreTransferThreshold | Amount of data moved from datastore to external services before raising alert. |
Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.