Exfiltration Over Web Service: Exfiltration Over Webhook `T1567.004`

Tactic: Exfiltration

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello. When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DestinationHostname`	1	`contains` 1, `ends_with` 1, `eq` 1, `starts_with` 1	`.4shared.com`, `.aternos.me`, `.b-cdn.net`
`event.category`	1	`eq` 1	`network`
`event.type`	1	`eq` 1	`start`
`host.os.type`	1	`eq` 1

Top indicator values (102 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DestinationHostname`	`contains`	`.portmap.` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`contains`	`dl.dropboxusercontent.` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.4shared.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.aternos.me` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.b-cdn.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.blob.core.windows.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.blob.storage.azure.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.blogspot.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.cdnmegafiles.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.getmyip.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.ngrok-free.app` elasticUnusual Network Connection to Suspicious Web Service	1	2
`DestinationHostname`	`ends_with`	`.ngrok.io` elasticUnusual Network Connection to Suspicious Web Service	1	2
`DestinationHostname`	`ends_with`	`.onedrive.org` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.pcloud.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.publicvm.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.sharepoint.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.trycloudflare.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.yandex.ru` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.zulipchat.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`azurewebsites.net` elasticUnusual Network Connection to Suspicious Web Service	1	2
`DestinationHostname`	`ends_with`	`infinityfreeapp.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`localtunnel.me` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`localxpose.io` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`notabug.org` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`pagekite.me` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`serveo.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`upload.ee` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`eq`	`?.docs.live.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`eq`	`?.top4top.io` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`eq`	`api.anonfiles.com` elasticUnusual Network Connection to Suspicious Web Service	1

Exclusions (26 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`DestinationHostname`	`ends_with`	`.azurewebsites.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.b-cdn.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.blob.core.windows.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.blob.storage.azure.net` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.blogspot.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`ends_with`	`.sharepoint.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`eq`	`api.onedrive.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`eq`	`drive.google.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`eq`	`onedrive.live.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`in`	`cdn.discordapp.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`in`	`content.dropboxapi.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`in`	`discord.com` elasticUnusual Network Connection to Suspicious Web Service	1
`DestinationHostname`	`in`	`dl.dropboxusercontent.com` elasticUnusual Network Connection to Suspicious Web Service	1
`Signature`	`contains`	`brave` elasticUnusual Network Connection to Suspicious Web Service	1
`Signature`	`contains`	`browser` elasticUnusual Network Connection to Suspicious Web Service	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Elastic 1 rule

Unusual Network Connection to Suspicious Web Service