When stolen data leaves through GitHub, Dropbox, MEGA or a Discord webhook, the destination looks like ordinary business traffic and most egress controls wave it through. MITRE ATT&CK tracks this as T1567 Exfiltration Over Web Service: adversaries use an existing, legitimate external web service to move data out rather than their primary command and control channel. This guide covers the four sub-techniques in ATT&CK v20, the log sources and correlations that catch them, the tenant and perimeter controls that refuse attacker-owned accounts, and the machine identity angle that recent supply chain worms exposed. It is for SOC analysts, detection engineers and cloud security architects, and it stays defensive throughout. For data theft as a whole, see the Data Exfiltration Guide.
Key takeaways
- The service is trusted, the account is not. T1567 almost always depends on an attacker-owned repository, storage account, paste or webhook, so controls that bind traffic to your own tenant or enterprise beat domain blocklists.
- Correlate file access with upload volume. Every ATT&CK v20 analytic for T1567 pairs sensitive file reads or archiving with an outbound HTTPS upload from a process that does not normally send much data.
- Stolen machine tokens make the attacker invisible. In the Shai-Hulud and Nx attacks the exfiltration repository was created inside the victim's own GitHub account with the victim's own token.
- Mitigations in ATT&CK are thin. v20 lists only M1021 Restrict Web-Based Content and M1057 Data Loss Prevention; tenant restrictions, data perimeters and runner egress policy have to be built around them.
- CI runners and servers need their own egress rules. Enterprise header controls usually cover managed user devices, not build runners or workloads, which is where token-stealing malware runs.
How the attack works
ATT&CK v20 places T1567 in the Exfiltration tactic (TA0010) on Windows, Linux, macOS, ESXi, Office Suite and SaaS. The technique description gives two reasons adversaries choose it: hosts are likely to be talking to the service already, so firewall rules may already permit it, and the provider supplies TLS encryption. The adversary needs only an account on the service, or a token for someone else's account, and a client that can upload.
| Sub-technique | What happens | Examples recorded in ATT&CK v20 |
|---|---|---|
| T1567.001 Exfiltration to Code Repository | Data is pushed to a repository through the service API or Git over HTTPS | Shai-Hulud, Mini Shai-Hulud, TeamPCP Cloud Stealer, Empire |
| T1567.002 Exfiltration to Cloud Storage | Files are copied to Dropbox, Google Drive, MEGA, OneDrive or a cloud bucket, often with a sync tool | 44 entries including Rclone, Scattered Spider, Storm-0501, Akira, Wizard Spider, HAFNIUM |
| T1567.003 Exfiltration to Text Storage Sites | Data is posted to a paste site such as Pastebin, sometimes using paid privacy features | No groups or software recorded in v20 |
| T1567.004 Exfiltration Over Webhook | Data is posted to a webhook URL (Discord, Slack, webhook.site), or an attacker links their webhook to a victim SaaS service for repeated automated export | Shai-Hulud, 2025 Poland Wiper Attacks |
The parent technique also lists campaigns such as ShinyHunters and the Salesforce Data Exfiltration campaign, plus ngrok as software. Closely related techniques sit alongside it: T1041 Exfiltration Over C2 Channel when the data rides the existing implant channel, T1048 Exfiltration Over Alternative Protocol for non-web protocols, T1537 Transfer Data to Cloud Account for cloud-to-cloud copies inside the provider, T1020 Automated Exfiltration and T1030 Data Transfer Size Limits. See the T1048 Exfiltration Over Alternative Protocol guide for the non-HTTPS channels.
Where it shows up
- Ransomware double extortion: operators stage archives and copy them to a storage service before encryption. CISA's advisory AA23-320A on Scattered Spider maps exfiltration to MEGA[.]NZ and to US-based data centres to T1567.002.
- Supply chain worms on developer machines and CI runners: the Shai-Hulud first wave used stolen GitHub tokens to create a public repository named "Shai-Hulud" and upload harvested secrets, and pushed a workflow that sent repository secrets to an external webhook.
- Exfiltration into the victim's own account: in the Nx s1ngularity attack the malware created public repositories named "s1ngularity-repository" in each victim's GitHub account and uploaded double base64-encoded results; GitGuardian counted 2,349 distinct secrets across 1,079 such repositories.
- Insiders and departing staff: personal cloud drives, personal Microsoft accounts and personal GitHub accounts on corporate devices.
- SaaS-to-SaaS: a webhook or connector registered in a collaboration or ticketing tool that pushes content to an external endpoint every time it changes.
Impact
The direct impact is loss of confidentiality: customer records, source code, credentials and intellectual property. Two features make T1567 worse than many channels. First, the data lands on infrastructure the defender cannot take down quickly, and a public repository or paste is readable by anyone, including other criminals, within minutes. Second, when the payload is credentials, the exfiltration is the start of the next intrusion: the Shai-Hulud page records that GitGuardian found 37 of 278 leaked secrets still valid after the initial clean-up. Every exposed machine credential then needs revocation, which turns a single incident into a fleet-wide rotation exercise.
Detection
ATT&CK v20 publishes one detection strategy per sub-technique (for example DET0548 for the parent and DET0570 for cloud storage). Their analytics share a pattern: sensitive file reads or archiving, followed by an outbound HTTPS upload from a process with no reason to send much data, to a known service domain. The table turns those analytics into log sources and correlations.
| Platform | Log source | What to correlate |
|---|---|---|
| Windows | Sysmon Event ID 1 (process create), 3 (network connection), 11 (file create), 22 (DNS query); Security 4688, 4663, 4656 | Office apps, PowerShell, wscript or mshta resolving and connecting to storage, paste or webhook domains after reading many files or writing an archive |
| Linux | auditd EXECVE and SYSCALL; flow records | tar or gzip followed by curl with POST or upload options, rclone copy, or git push from a host or account that does not normally push |
| macOS | Unified log | Non-networking apps or osascript making TLS uploads after reading user documents |
| ESXi | hostd and vmkernel logs | Datastore file reads followed by outbound HTTPS from vmx or hostd |
| SaaS and Microsoft 365 | Unified audit log (FileUploaded, FileCopied), webhook and connector registration events | Upload or copy rates above baseline; new webhooks pointing at external domains |
| Network edge | Proxy or SSE logs, NetFlow or IPFIX | High outbound-to-inbound byte ratio per host and destination; sign-ins to non-corporate tenants |
High-signal analytics
- Repository creation by a machine token: alert on repository creation, visibility changes to public, or new workflow files pushed by a token that belongs to CI, a bot or a service account. Both Shai-Hulud and Nx created repositories in victim accounts.
- Foreign tenant sign-ins: proxy logs showing sign-ins to Microsoft, Google or GitHub accounts that are not yours from managed devices. Tenant restriction blocks are themselves a signal: GitHub logs blocked requests in the audit log without an actor field.
- Sync tools on servers: rclone, MEGAsync or a cloud drive client executing on a file server, domain controller or ESXi host is rarely legitimate.
- Webhook POSTs from non-browser processes: script hosts or build steps sending POST requests to Discord, Slack or webhook.site URLs.
- Upload ratio outliers: D3FEND D3-PHDURA Per Host Download-Upload Ratio Analysis describes the baseline approach; tune per role so build servers and backup hosts have their own baseline.
Proxy logs often hold only the domain. Where TLS inspection is permitted, log the HTTP method and request size for storage and repository APIs; without it, rely on flow volume plus endpoint process context. See the NetFlow and IPFIX Flow Telemetry Guide.
Prevention and hardening
| Control | What it stops | Limits |
|---|---|---|
| Microsoft Entra tenant restrictions v2 (header sec-Restrict-Tenant-Access-Policy, value TenantId:policyGuid, or Windows GPO, or Global Secure Access) | Sign-ins to external Microsoft tenants and Microsoft accounts from managed networks and devices | Proxy signalling gives authentication plane protection only; data plane protection is in preview; consumer OneDrive anonymous access needs a proxy block |
| GitHub enterprise access restrictions (header sec-GitHub-allowed-enterprise) | Sign-in and API or Git over HTTPS use by accounts outside your enterprise; outside personal access tokens are blocked | Requires Enterprise Managed Users and a break-and-inspect proxy; does not cover Git over SSH (block port 22 and ssh.github.com) or runners |
| AWS data perimeter: aws:ResourceOrgID in SCPs and VPC endpoint policies | Writes from your principals to buckets outside your organisation | Cross-Region requests bypass a VPC endpoint in another Region; some sharing paths cannot be constrained by this key |
| Google Cloud VPC Service Controls perimeters with egress rules | Copying data to resources outside the perimeter, such as a public bucket or external BigQuery table | Needs dry run mode first to find legitimate flows |
| Proxy or SSE category and instance controls (M1021, D3-OTF) | Unsanctioned storage, paste and webhook services; personal instances of sanctioned services | Allowlists need ownership and an exception process |
| DLP on endpoint, proxy and SaaS (M1057) | Uploads of classified content through browsers and sanctioned apps | Blind to encrypted or encoded archives; tune on labels, not regex alone |
- Inventory first: list the storage, repository and collaboration services the business actually uses, and which tenants and enterprises are yours.
- Monitor before blocking: run tenant restrictions, SSE policies and VPC Service Controls in log or dry run mode for two to four weeks and review the hits.
- Block categories with no business owner: paste sites, anonymous file drops and webhook test services first.
- Enforce tenant binding: turn on tenant restrictions and enterprise access restrictions for managed devices, with a named exception group for partner collaboration.
- Constrain servers and runners: deny direct internet egress from servers and self-hosted runners, allowing only the package registries and APIs each one needs.
- Roll back safely: keep every block as a reversible policy change with a documented owner, and re-run the dry run when a new SaaS service is adopted.
For small organisations without a proxy, Windows GPO-based tenant restrictions, a DNS filtering service blocking the paste and anonymous file-sharing categories, and alerts on repository visibility changes cover most of the risk. Larger estates should route all user and workload egress through inspected paths. See the CASB Guide and the Cloud Data Perimeter Guide.
Where identity fits
T1567 is an identity problem as much as a network one. The upload is authenticated, so the question is always "whose account received the data?" When the answer is a token stolen from the victim, as in the Nx and Shai-Hulud attacks, the traffic goes to your own organisation's repositories and passes every tenant check. Defences that help: fine-grained, short-lived tokens for CI and bots rather than classic personal access tokens; organisation policies that prevent members creating public repositories or changing visibility; trusted publishing for package registries so publishing tokens are not stored on runners; and fast revocation runbooks. See the npm Tokens Security Guide and the GitHub and GitHub Actions Security Guide.
Lessons from incidents
- Exfiltration channels can be self-hosted by the victim: Nx s1ngularity placed stolen secrets in public repositories in the victims' own accounts. An allowlist for github.com could not have helped; alerting on new public repositories created by automation could.
- Workflows are exfiltration code: Shai-Hulud pushed a branch with a GitHub Actions workflow that posted secrets to a webhook. Require review for workflow file changes and restrict runner egress.
- Bulk storage uploads precede ransomware: AA23-320A shows exfiltration to MEGA before encryption; upload alerts on file servers are an early warning, not just a forensic artefact.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection, SC-7(10) Prevent Exfiltration, AC-4 Information Flow Enforcement | Egress architecture, tenant binding, perimeters |
| NIST SP 800-53 Rev. 5 | SI-4(4) Inbound and Outbound Communications Traffic, SI-4(18) Analyze Traffic and Covert Exfiltration | Upload volume and destination analytics |
| NIST CSF 2.0 | PR.DS-02, DE.CM-01 | Protecting data in transit; monitoring networks |
| MITRE ATT&CK v20 | M1021, M1057 | The two listed mitigations |
| MITRE D3FEND | D3-OTF Outbound Traffic Filtering, D3-PHDURA Per Host Download-Upload Ratio Analysis | Prevention and detection techniques |
Practitioner checklist
- Map which storage, repository, paste and webhook services each user group, server role and runner pool genuinely needs.
- Ingest Sysmon 1, 3, 11 and 22 (or EDR equivalents), auditd EXECVE, proxy logs and flow data into one place with host and process fields joined.
- Alert on repository creation, public visibility changes and workflow pushes by CI, bot and service account tokens.
- Deploy Entra tenant restrictions v2 and GitHub enterprise access restrictions in monitor mode, then enforce.
- Apply aws:ResourceOrgID guardrails or VPC Service Controls egress rules to stop copies to buckets outside your organisation.
- Deny direct internet egress from servers and self-hosted runners; allow only named registries and APIs.
- Block paste, anonymous file-drop and webhook test services where no business owner exists.
- Track metrics: share of egress through inspected paths, blocked foreign-tenant sign-ins per month, mean time to revoke a token exposed in an upload, and number of servers able to reach storage services directly.
Standards and references
- MITRE ATT&CK: Exfiltration Over Web Service (T1567)
- Microsoft Learn: Set up tenant restrictions v2
- GitHub Docs: Restricting access to GitHub.com using a corporate proxy
- AWS: Building a Data Perimeter on AWS, perimeter implementation
- Google Cloud: Overview of VPC Service Controls
- CISA: Scattered Spider advisory AA23-320A
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Data Exfiltration Guide · T1102 Web Service Defensive Guide · T1048 Exfiltration Over Alternative Protocol · Data Exfiltration Playbook