T1567.001 — Exfiltration to Code Repository

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Windows

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.…

Sub-technique of Exfiltration Over Web Service (T1567).

Sigma detection rules (4)

title: "T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository"
id: d8655be9-b375-4c7b-8351-2d42ffa66bb6
description: 'Detection Strategy for Exfiltration to Code Repository. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: MonitoredDomains, ExfilVolumeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1567/001
author: Shahrukh Khan
date: 2026-03-06
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_dns:
    EventID: '22'
    QueryName|contains:
      - 'github.com'
      - 'api.github.com'
      - 'raw.githubusercontent.com'
      - 'gist.github.com'
      - 'gist.githubusercontent.com'
      - 'gitlab.com'
      - 'bitbucket.org'

  selection_conn:
    EventID: '3'
    DestinationHostname|contains:
      - 'github.com'
      - 'api.github.com'
      - 'raw.githubusercontent.com'
      - 'gist.github.com'
      - 'gist.githubusercontent.com'
      - 'gitlab.com'
      - 'bitbucket.org'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate developer activity: git clone/push/pull, CI/CD runners, package managers.

level: medium

title: "T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository"
id: 9f860e55-57b3-4b3e-89e6-d192cfbed3ab
description: 'Detection Strategy for Exfiltration to Code Repository. The original rule required the code-host domain to appear literally in argv (git push <url>), missing the far more common git push origin main pattern where the remote is a named alias resolved from .git/config rather than typed on the command line. Added selection_remote_config_read, which correlates the git push invocation with the accompanying PATH record for opening .git/config, so aliased-remote pushes are also flagged -- at the cost of matching virtually all git push activity when no literal domain is present in argv; downstream correlation with RepoDomainList/network telemetry is required to confirm destination. Tune using: WorkHours, RepoDomainList.'
references:
  - https://attack.mitre.org/techniques/T1567/001
author: Shahrukh Khan
date: 2026-06-08
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_push:
    type: EXECVE
    a0|endswith: '/git'
    a1|contains|all:
      - 'push'
  selection_remote_literal:
    a2|contains:
      - 'github.com'
      - 'gitlab.com'
      - 'bitbucket.org'
  selection_remote_config_read:
    type: PATH
    name|endswith: '.git/config'
    nametype: NORMAL

  condition: selection_push and (selection_remote_literal or selection_remote_config_read)

falsepositives:
  - 'Routine developer pushes to sanctioned code repositories; scope to unsanctioned personal accounts/domains not in RepoDomainList and outside WorkHours.'
  - 'Because resolving a named remote (e.g. git push origin main) always reads .git/config as part of the push, selection_remote_config_read will match essentially every git push invocation regardless of destination, not just pushes to public code-hosting services; treat matches that lack a literal code-host domain in argv as lower-confidence and enrich with DNS/network telemetry or a repo allowlist before escalating.'

level: medium

title: "T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository"
id: aedf091c-5a97-4773-b331-61ad396c4980
description: 'Detection Strategy for Exfiltration to Code Repository. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredApplications.'
references:
  - https://attack.mitre.org/techniques/T1567/001
author: Shahrukh Khan
date: 2026-01-04
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/git'
    CommandLine|contains|all:
      - 'push'
  filter:
    CommandLine|contains: 'origin'

  condition: selection and not filter

falsepositives:
  - Nearly all legitimate developer activity is git push to origin, so this filter suppresses the common case, but any push to a non-origin or freshly added remote still generates significant false positives from normal multi-remote workflows.

level: medium

title: "T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository"
id: a051f85d-c095-42bb-a225-e3d05b629684
description: 'Detection Strategy for Exfiltration to Code Repository. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DatastoreTransferThreshold.'
references:
  - https://attack.mitre.org/techniques/T1567/001
author: Shahrukh Khan
date: 2026-06-29
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.001

logsource:
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains: 'curl '
  selection_repo:
    CommandLine|contains:
      - 'github.com'
      - 'gitlab.com'
      - 'bitbucket.org'
  selection_upload:
    CommandLine|contains:
      - '-F '
      - '--data-binary'
      - '-T '

  condition: selection_tool and selection_repo and selection_upload

falsepositives:
  - Legitimate CI or automation scripts pushing diagnostic artifacts to an internal git mirror hosted on one of these domains; unlikely on a production ESXi host but review DatastoreTransferThreshold volume before escalating.

level: high

Related sub-techniques

• T1567.003 Exfiltration to Text Storage Sites
• T1567.004 Exfiltration Over Webhook
• T1567.002 Exfiltration to Cloud Storage

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1567.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan