T1567.004 Exfiltration Over Webhook — Attack Simulation

Technique description

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira,…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Exfiltrate staged data to a Microsoft Teams webhook (PowerShell)
  windowsautomatedpowershell

  Procedure 35ad6590-2207-4b14-bf8f-9899470d7156; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Exfiltrate staged file to a Discord webhook with curl (bash)
  linuxmacosautomatedbash

  Procedure 40c44d16-bb49-4d14-aafa-f9ba7e6e6c5b; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Exfiltrate staged data to a Slack webhook with curl (sh)
  linuxmacosautomatedsh

  Procedure c666acd6-6ff5-4d28-9490-195d89cd4337; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Exfiltrate staged data to a Discord webhook (PowerShell)
  windowsautomatedpowershell

  Procedure f0057c81-24dc-4a2e-b658-5809c242180b; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.