Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002)

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Windows

The interactive view maps 1 detection strategy, 1 mitigation, 25 threat groups, 16 software entries, 3 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Exfiltration Over Web Service (T1567).

Overview

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Examples of cloud storage services include Dropbox and Google Docs. Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Explore

• Open T1567.002 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1567.002
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan