Wiki › Techniques, Tactics & Procedures (TTPs) › Exfiltration › Exfiltration Over Web Services

Exfiltration Over Web Services

3 min read

Jump to:

Overview

Exfiltration Over Web Services is a technique used by adversaries to transfer stolen data from a compromised environment to an external location via legitimate web-based services. This method leverages common web protocols and cloud platforms to evade detection and bypass traditional network security controls. It typically occurs during the exfiltration phase of the attack lifecycle, enabling attackers to discreetly remove sensitive information.

Attack Objective

The primary goal is data theft through covert extraction of information.
Supports the Exfiltration stage of the attack lifecycle.
Advances the attacker’s position by enabling secure and stealthy removal of valuable data, often facilitating further exploitation or monetization.

How the Technique Works

Adversaries use web services such as cloud storage platforms, webmail, social media, or other HTTP/HTTPS-based services to upload or transmit data from the target environment. By leveraging widely used and trusted services, attackers can blend exfiltration traffic with normal user activity, reducing the likelihood of detection. Data may be encoded, compressed, or segmented before transmission to avoid triggering security alerts.

Common Methods & Variations

Uploading data to cloud storage services (e.g., file sharing or object storage platforms).
Using webmail or messaging platforms to send data as attachments or messages.
Embedding data within legitimate web traffic or API calls to popular web services.
Variants include on-premises environments exfiltrating to cloud services, cloud workloads exfiltrating data externally, and identity-based methods leveraging compromised credentials.
Use of living-off-the-land techniques by abusing legitimate tools and protocols versus deploying custom exfiltration tools.

Indicators of Compromise (IOCs)

Unusual volumes of outbound web traffic, especially to uncommon destinations or at irregular times.
Authentication logs showing access to web services from unexpected accounts or devices.
Network logs indicating data uploads or API calls inconsistent with normal user behavior.
Endpoint artifacts such as scripts or tools invoking web service APIs.
Cloud service logs revealing anomalous file uploads or data transfers.

Detection Strategies

Monitoring network telemetry including proxy, firewall, and DNS logs for anomalous web service usage.
Behavioral analysis to identify deviations from established user and system patterns.
Correlation of authentication events with data transfer activities.
Use of endpoint detection to identify suspicious processes interacting with web services.
Cloud security monitoring to detect unusual API activity or data movement.

Mitigation & Prevention

Implement strict egress filtering and web proxy controls to limit unauthorized data transfers.
Enforce multi-factor authentication and least privilege principles for access to web services.
Apply data loss prevention (DLP) solutions to monitor and block sensitive data exfiltration.
Configure cloud service permissions and audit logging to restrict and track data uploads.
Educate users on secure handling of sensitive information and risks of unauthorized data sharing.

Response Considerations

Immediately isolate affected systems to prevent further data exfiltration.
Analyze network and service logs to identify the scope and timeline of data transfers.
Review compromised credentials and revoke or reset as necessary.
Enhance monitoring and tighten controls on web service access post-incident.
Conduct a thorough investigation to identify root cause and implement remediation measures.

Related Techniques

Data Staged: Preparation of data prior to exfiltration.
Exfiltration Over C2 Channel: Using command and control channels for data transfer.
Credential Access: Compromise of credentials facilitating access to web services.
Command and Control: Establishing communication channels that may be used for exfiltration.

Mapping & References

MITRE ATT&CK Tactic: Exfiltration
MITRE ATT&CK Technique: Exfiltration Over Web Service (T1567.002)
Public research and incident reports from cybersecurity vendors and CERTs documenting use of cloud services in data exfiltration.

Tags: Cloud Security cyber threats data theft Detection endpoint security Exfiltration Incident Response MITRE ATT&CK network security Prevention Web Services