Developers paste snippets into text storage sites all day. MITRE T1567.003, Exfiltration to Text Storage Sites, is about adversaries using those same sites, such as pastebin[.]com, to carry stolen data out. It is an exfiltration technique for Linux, macOS, Windows and ESXi.
How attackers use it
Text storage sites are often used to host code for command and control, but MITRE says they can also receive collected data. Paid features and encryption options can help conceal and store that data more securely. MITRE separates this from exfiltration to a code repository, which uses repository APIs.
How to detect it
Look for processes that have no reason to post to paste sites doing so. MITRE's analytics describe:
- powershell.exe, wscript.exe or Office apps sending HTTP POST or PUT requests to text storage domains, especially after file access in sensitive directories.
curl,wgetor scripts posting to paste-style services after files were compressed or read.- osascript, curl or Office apps on macOS doing the same after unusual clipboard or file reads.
- ESXi services such as vmx or hostd sending POST requests to such sites.
Web proxy logs with process context are the best place to start.
How to reduce the risk
MITRE lists restricting web-based content: use web proxies to enforce an external communication policy that prevents unauthorized external services. If nobody on a server network needs a paste site, block it there and alert on attempts.
Quick check
How does this differ from exfiltration to a code repository?
MITRE notes that code repository exfiltration uses repository APIs, while this technique uses text storage sites such as Pastebin.
