CmdID

CmdID / Techniques

T1567 Exfiltration Over Web Service

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. MITRE ATT&CK

3 programs on CmdID 4 Sigma rules T1567 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
configsecuritypolicy.exeUploadcurlits Sigma rulesdatasvcutil.exeUpload

Sigma rules tagged with it

process creation, the highest levels first
mediumArbitrary File Download Via ConfigSecurityPolicy.EXEfrack113 · Windows
mediumLOLBAS Data Exfiltration by DataSvcUtil.exeIalle Teixeira @teixeira0xfffff, Austin Songer @austinsonger · Windows
mediumPotential Data Exfiltration Via Curl.EXEFlorian Roth (Nextron Systems), Cedric MAURUGEON (Update) · Windows
mediumSuspicious Curl File Upload - LinuxNasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · Linux