T1567.004 — Exfiltration Over Webhook

Tactic: Exfiltration · Platforms: ESXi, Linux, macOS, Office Suite, SaaS, Windows

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial…

Sub-technique of Exfiltration Over Web Service (T1567).

Sigma detection rules (5)

title: "T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook"
id: ed556e25-1330-4ae5-8013-19fe541bf666
description: 'Detection Strategy for Exfiltration Over Webhook: non-browser processes establishing outbound connections to known webhook-hosting domains (Discord, Slack, webhook.site), consistent with a script or tool pushing data to a webhook endpoint outside the primary C2 channel. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: WebhookDomains, UploadSizeThreshold, ApprovedApps.'
references:
  - https://attack.mitre.org/techniques/T1567/004
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.004

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'discord.com'
      - 'discordapp.com'
      - 'hooks.slack.com'
      - 'webhook.site'

  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'

  condition: selection and not filter_browser

falsepositives:
  - Legitimate integrations/agents posting to webhook endpoints from an approved automation process (CI/CD agents, chat-ops bots); tune with WebhookDomains, UploadSizeThreshold, ApprovedApps.

level: medium

title: "T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook"
id: bc0ddfbb-198f-4d39-86eb-5dbe07e377a3
description: 'Detection Strategy for Exfiltration Over Webhook. The prior -X/POST check required both tokens to co-occur in a single argv field, which is only true for the merged "-XPOST" curl form and missed the far more common space-separated "curl -X POST <url>" invocation (where -X and POST land in separate argv positions); the hostname check also assumed the webhook domain was always at a2. Fixed by checking -X and POST as independent optional argv values and matching the webhook domain across argv positions a1 through a4. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedTools, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1567/004
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.004

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/curl'
  selection_webhook:
    - a1|contains:
        - 'discord.com/api/webhooks'
        - 'hooks.slack.com'
    - a2|contains:
        - 'discord.com/api/webhooks'
        - 'hooks.slack.com'
    - a3|contains:
        - 'discord.com/api/webhooks'
        - 'hooks.slack.com'
    - a4|contains:
        - 'discord.com/api/webhooks'
        - 'hooks.slack.com'

  condition: selection and selection_webhook

falsepositives:
  - Legitimate CI/CD or monitoring integrations post to Slack/Discord webhooks constantly; scope AllowedTools to known automation accounts and unusual TimeWindow activity.

level: high

title: "T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook"
id: db2dea73-659b-40ef-bdeb-b50c0d853df2
description: 'Detection Strategy for Exfiltration Over Webhook. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WebhookEndpoints, EntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1567/004
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/curl'
    CommandLine|contains|all:
      - '-X'
      - 'POST'
    CommandLine|re: 'hooks\.(slack|discord)\.com'

  condition: selection

falsepositives:
  - Legitimate CI or monitoring scripts that post status updates to an approved Slack or Discord webhook.

level: medium

title: "T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook"
id: 1d72be3c-2eed-4690-8b35-285c20e2688a
description: 'Detection Strategy for Exfiltration Over Webhook. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: WebhookRegistrations, ExternalDomains.'
references:
  - https://attack.mitre.org/techniques/T1567/004
author: Shahrukh Khan
date: 2026-03-14
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.004

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Add service principal'
      - 'Add OAuth2PermissionGrant'
    Parameters.Value|contains: 'Files.Read'

  condition: selection

falsepositives:
  - Legitimate registration of an approved third-party integration app that requires webhook-based file access, such as an e-signature or DMS platform.

level: high

title: "T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook"
id: da761570-152d-4305-af39-09b128fc9e6d
description: 'Detection Strategy for Exfiltration Over Webhook. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DatastoreExfilThreshold, ApprovedIntegrations.'
references:
  - https://attack.mitre.org/techniques/T1567/004
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.exfiltration
  - attack.t1567.004

logsource:
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_webhook:
    CommandLine|contains:
      - 'discord.com/api/webhooks'
      - 'hooks.slack.com'
      - 'webhook.site'

  condition: selection_tool and selection_webhook

falsepositives:
  - A legitimate but unusual monitoring integration that posts host alerts to a chat webhook directly from the ESXi Shell rather than through ApprovedIntegrations such as vRealize or a SIEM forwarder.

level: high

Related sub-techniques

• T1567.003 Exfiltration to Text Storage Sites
• T1567.002 Exfiltration to Cloud Storage
• T1567.001 Exfiltration to Code Repository

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1567.004 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan