1. Home
  2. ATT&CK Techniques
  3. T1567 Exfiltration Over Web Service

T1567 Exfiltration Over Web Service Mappings

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-16 Security and Privacy Attributes Protects T1567 Exfiltration Over Web Service
AC-02 Account Management Protects T1567 Exfiltration Over Web Service
AC-20 Use of External Systems Protects T1567 Exfiltration Over Web Service
AC-23 Data Mining Protection Protects T1567 Exfiltration Over Web Service
AC-03 Access Enforcement Protects T1567 Exfiltration Over Web Service
AC-04 Information Flow Enforcement Protects T1567 Exfiltration Over Web Service
AC-06 Least Privilege Protects T1567 Exfiltration Over Web Service
CA-03 Information Exchange Protects T1567 Exfiltration Over Web Service
CA-07 Continuous Monitoring Protects T1567 Exfiltration Over Web Service
SA-08 Security and Privacy Engineering Principles Protects T1567 Exfiltration Over Web Service
SA-09 External System Services Protects T1567 Exfiltration Over Web Service
SC-28 Protection of Information at Rest Protects T1567 Exfiltration Over Web Service
SC-31 Covert Channel Analysis Protects T1567 Exfiltration Over Web Service
SC-07 Boundary Protection Protects T1567 Exfiltration Over Web Service
SI-03 Malicious Code Protection Protects T1567 Exfiltration Over Web Service
SI-04 System Monitoring Protects T1567 Exfiltration Over Web Service
SR-04 Provenance Protects T1567 Exfiltration Over Web Service
PUR-IP-E5 Information Protection Technique Scores T1567 Exfiltration Over Web Service
DEF-SecScore-E3 Secure Score Technique Scores T1567 Exfiltration Over Web Service
DEF-AIR-E5 Automated Investigation and Response Technique Scores T1567 Exfiltration Over Web Service
DO365-ATH-E5 Advanced Threat Hunting Technique Scores T1567 Exfiltration Over Web Service

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1567.004 Exfiltration Over Webhook 6
T1567.001 Exfiltration to Code Repository 3
T1567.003 Exfiltration to Text Storage Sites 3
T1567.002 Exfiltration to Cloud Storage 4