T1567.003 — Exfiltration to Text Storage Sites

Tactic: Exfiltration · Platforms: Linux, macOS, Windows, ESXi

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication…

Sub-technique of Exfiltration Over Web Service (T1567).

Sigma detection rules (4)

title: "T1567.003 Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
id: 90785397-e8fc-4a26-a013-c4dde8c93450
description: 'Detection Strategy for Exfiltration to Text Storage Sites. (Retargeted from the original process_creation label to network_connection — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TextStorageDomains, UploadSizeThreshold, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1567/003
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.003

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\curl.exe'
    CommandLine|contains:
      - 'pastebin.com'
      - 'paste.ee'

  condition: selection

falsepositives:
  - Legitimate developer/IT scripted use of these paste services for entirely benign sharing.

level: medium

title: "T1567.003 Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
id: 8c6dc271-eaf2-45b5-b08c-009824056262
description: 'Detects curl/wget invocations that both reference a text-paste-site domain and carry an upload-indicating argument (curl -d/--data/-F/-T or wget --post-data/--post-file), distinguishing outbound data exfiltration from simple payload staging/download against the same domains. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedTools, WorkHours.'
references:
  - https://attack.mitre.org/techniques/T1567/003
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
  selection_domain:
    - a1|contains:
        - 'pastebin.com'
        - 'transfer.sh'
        - 'paste.ee'
        - 'ghostbin.com'
    - a2|contains:
        - 'pastebin.com'
        - 'transfer.sh'
        - 'paste.ee'
        - 'ghostbin.com'
    - a3|contains:
        - 'pastebin.com'
        - 'transfer.sh'
        - 'paste.ee'
        - 'ghostbin.com'
    - a4|contains:
        - 'pastebin.com'
        - 'transfer.sh'
        - 'paste.ee'
        - 'ghostbin.com'
  selection_upload:
    - a1:
        - '-d'
        - '--data'
        - '-F'
        - '-T'
        - '--post-data'
        - '--post-file'
    - a2:
        - '-d'
        - '--data'
        - '-F'
        - '-T'
        - '--post-data'
        - '--post-file'
    - a3:
        - '-d'
        - '--data'
        - '-F'
        - '-T'
        - '--post-data'
        - '--post-file'
    - a4:
        - '-d'
        - '--data'
        - '-F'
        - '-T'
        - '--post-data'
        - '--post-file'

  condition: selection_tool and selection_domain and selection_upload

falsepositives:
  - Developers legitimately uploading non-sensitive logs/snippets via paste sites using the same upload flags; scope AllowedTools/WorkHours and payload-size heuristics to reduce noise.

level: high

title: "T1567.003 Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
id: 98d5a0f8-48fa-4a77-8deb-b0ea1d5e928a
description: 'Detection Strategy for Exfiltration to Text Storage Sites. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedApps, EntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1567/003
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/curl'
    CommandLine|contains:
      - 'pastebin.com'
      - 'gist.githubusercontent.com'
      - 'hastebin.com'

  condition: selection

falsepositives:
  - Developers legitimately fetching public code snippets or gists as part of normal scripting work.

level: medium

title: "T1567.003 Exfiltration Over Web Service: Exfiltration to Text Storage Sites"
id: 95bf65ec-c5ed-4233-b370-321af1b88052
description: 'Detection Strategy for Exfiltration to Text Storage Sites. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DatastoreExfilThreshold, ApprovedDestinations.'
references:
  - https://attack.mitre.org/techniques/T1567/003
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.003

logsource:
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_paste:
    CommandLine|contains:
      - 'pastebin.com'
      - 'hastebin.com'
      - 'ix.io'
      - 'termbin.com'

  condition: selection_tool and selection_paste

falsepositives:
  - Almost no legitimate ESXi administration workflow posts data to text-paste sites; a benign case would be an administrator quickly sharing a config snippet for troubleshooting, which should be uncommon against ApprovedDestinations.

level: high

Related sub-techniques

• T1567.004 Exfiltration Over Webhook
• T1567.002 Exfiltration to Cloud Storage
• T1567.001 Exfiltration to Code Repository

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1567.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan