Exfiltration to a Code Repository: Detecting It (T1567.001)

Developer traffic to code hosting sites is normal on almost every network. MITRE T1567.001, Exfiltration to Code Repository, uses that cover. It falls under exfiltration and applies to ESXi, Linux, macOS and Windows.

How attackers use it

Instead of the main command and control channel, adversaries send data to a code repository. These services often have APIs, for example https://api.github.com, reached over HTTPS, which adds a layer of protection. If the service is popular and already used by hosts in the network, it gives significant cover.

How to detect it

MITRE's analytics pair a read of sensitive files with an upload to a repository host:

• PowerShell, Git or curl making HTTPS POST requests to repository APIs right after large file reads, with sensitive folders such as Documents or Finance as the source.
• git, curl or python scripts that package files with tar or gzip and then upload, including unusual git push activity outside normal developer hours.
• Office or scripting apps sending unusual HTTPS traffic to repository APIs with high outbound-to-inbound ratios.
• ESXi processes such as vmx or hostd opening sessions to external repositories after datastore reads.

The question to ask of each hit is simple: is this machine used for development?

How to reduce the risk

MITRE lists restricting web-based content: use web proxies to enforce an external communication policy that prevents use of unauthorized external services. Allow your approved repository organizations and block or alert on the rest, rather than allowing a whole domain.

Secrets sitting in repositories are a related risk, since a stolen token for a repository is also a way out. Scanning code and history for exposed credentials shortens that exposure.

Try it yourself

Click through it at your own pace, or open it full screen.

Check your own environment

• Which repository hosts can servers and non-developer laptops reach?
• Can you tell personal accounts from company organizations in proxy logs?
• Does an alert fire for a first-time push from a host that has never used Git?

Quick check

Sources

• MITRE ATT&CK T1567.001, Exfiltration to Code Repository