T1567 Exfiltration Over Web Service — Detection Rules

Source-backed rule directory

• Communication To Ngrok Tunneling Service - Linux · test · high · {"product":"linux","category":"network_connection"}
• Suspicious Curl File Upload - Linux · test · medium · {"category":"process_creation","product":"linux"}
• Monero Crypto Coin Mining Pool Lookup · stable · high · {"category":"dns"}
• Network Connection Initiated To BTunnels Domains · test · medium · {"category":"network_connection","product":"windows"}
• Network Connection Initiated To Cloudflared Tunnels Domains · test · medium · {"category":"network_connection","product":"windows"}
• Process Initiated Network Connection To Ngrok Domain · test · high · {"category":"network_connection","product":"windows"}
• Communication To Ngrok Tunneling Service Initiated · test · high · {"category":"network_connection","product":"windows"}
• Suspicious Non-Browser Network Communication With Telegram API · test · medium · {"product":"windows","category":"network_connection"}
• Network Connection Initiated To Visual Studio Code Tunnels Domain · test · medium · {"category":"network_connection","product":"windows"}
• Arbitrary File Download Via ConfigSecurityPolicy.EXE · test · medium · {"category":"process_creation","product":"windows"}
• LOLBAS Data Exfiltration by DataSvcUtil.exe · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1567 Exfiltration Over Web Service

MATCH(upload_to_disallowed_web_service) OR SUM(upload_bytes BY user, 15m) >= threshold -> ALERT

• Proxy and Secure Web Gateway Logs
• Data Loss Prevention Logs
• Cloud Data-Plane Access Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0548 Detection Strategy for Exfiltration Over Web Service

AN1511 Analytic 1511

Processes that normally do not initiate network communications suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios. Defender view: correlation between process creation logs (e.g., Word, Excel, PowerShell) and subsequent anomalous network traffic volumes toward common web services (Dropbox, Google Drive, OneDrive).

AN1512 Analytic 1512

Processes (tar, curl, python scripts) accessing large file sets and initiating outbound HTTPS POST requests with payload sizes inconsistent with baseline activity. Defender perspective: detect abnormal sequence of file archival followed by encrypted uploads to external web services.

AN1513 Analytic 1513

Office apps or scripts writing files followed by xattr manipulation (to evade quarantine) and subsequent HTTPS uploads. Defender perspective: anomalous file modification + outbound TLS traffic originating from non-networking apps (Word, Excel, Preview).

AN1514 Analytic 1514

Abnormal API calls from user accounts invoking file upload endpoints outside normal baselines (M365, Google Drive, Box). Defender perspective: monitor unified audit logs for elevated frequency of Upload, Create, or Copy operations from compromised accounts.

AN1515 Analytic 1515

ESXi guest OS or management interface processes establishing unexpected external HTTPS connections. Defender perspective: monitor vmx or hostd processes making outbound web requests with significant data transfer.