Webhooks let one service push data to another without polling. MITRE T1567.004, Exfiltration Over Webhook, is about turning that convenience into an exit route. It applies to ESXi, Linux, macOS, Office Suite, SaaS and Windows.
How attackers use it
Public and commercial services, among them Discord, Slack and webhook.site, can create webhook endpoints that other services such as GitHub, Jira or Trello post to when something changes.
MITRE describes two ways in. An adversary can link an adversary-owned environment to a victim-owned SaaS service to get repeated automated exfiltration of emails, chat messages and other data. Or the adversary can skip the link and post staged data straight to the webhook URL. Access is usually over HTTPS, and traffic to a commonly used SaaS or collaboration service blends in.
How to detect it
MITRE's analytics have an endpoint view and a SaaS view:
- Windows: powershell.exe, wscript.exe or mshta.exe posting to webhook endpoints on Discord, Slack or webhook.site.
- Linux:
curl,wgetor scripts posting encoded or bulk data, often after files were compressed or accessed. - macOS: osascript, curl or Automator workflows posting after clipboard or file reads.
- VMware: management daemons posting to webhook endpoints, chained with unusual datastore or log access.
- SaaS: webhook configurations that point to external or untrusted domains, repeated automated exports or suspicious endpoint registrations.
How to reduce the risk
MITRE lists data loss prevention, which can detect and block sensitive data being uploaded to web services through browsers. Add a periodic review of webhooks configured in your own SaaS tools, and remove ones nobody can explain.
Webhook URLs are bearer secrets, since anyone holding the URL can post to it. Keep them out of source code and scan repositories for them.
Try it yourself
Click through it at your own pace, or open it full screen.
Check your own environment
- Export the list of webhooks and connected apps from your chat, ticketing and source hosting tools. Who owns each one, and where does it point?
- Does your proxy alert on scripting processes calling webhook domains?
- Are webhook URLs stored in a secrets manager instead of in code?
Quick check
What are the two webhook exfiltration methods MITRE describes?
Linking an adversary-owned environment to a victim SaaS service for repeated automated exfiltration, or posting staged data directly to the webhook URL.
