Exfiltration Over Web Service: Exfiltration to Code Repository

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

ID: T1567.001
Sub-technique of:  T1567
Tactic: Exfiltration
Platforms: Linux, Windows, macOS
Version: 1.1
Created: 09 March 2020
Last Modified: 15 September 2023

Procedure Examples

ID Name Description
S0363 Empire

Empire can use GitHub for data exfiltration.[1]

Mitigations

ID Mitigation Description
M1021 Restrict Web-Based Content

Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed command and arguments that may exfiltrate data to a code repository rather than over their primary command and control channel.

DS0022 File File Access

Monitor for files being accessed to exfiltrate data to a code repository rather than over their primary command and control channel.

DS0029 Network Traffic Network Traffic Content

Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Network Traffic Flow

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor for use of code repositories for data exfiltration.

Analytic 1 - Suspicious Data Exfil

suspicious_exfil = filter network_traffic where (httpHost = "github.com" or httpHost ="justpaste.it" or httpHost= "pastebin.com" or httpHost="onpaste.com" or httpHost="transfernow.net" or httpHost = "codepad.org")

References