Most networks allow outbound HTTPS to popular services, and that is the point. MITRE T1567, Exfiltration Over Web Service, describes adversaries using a legitimate external web service to move data out instead of their main command and control channel. It is an exfiltration technique that applies to ESXi, Linux, macOS, Office Suite, SaaS and Windows.
How attackers use it
MITRE gives two reasons the approach works. Popular services give significant cover because hosts in the network probably already talk to them, and firewall rules may already allow that traffic. Also, web service providers commonly use SSL/TLS, which adds another layer of protection.
The parent technique has four subtechniques, each with its own guide: exfiltration to a code repository (T1567.001), to cloud storage (T1567.002), to text storage sites (T1567.003) and over a webhook (T1567.004). They share a shape: collect, often compress, then send to a trusted destination.
How to detect it
Because the destination is trusted, detection leans on the source: which process is sending, how much, and what it read first. MITRE's analytics by platform:
- Windows: processes that do not normally use the network, such as Word, Excel or PowerShell, suddenly making outbound HTTPS connections with a high outbound-to-inbound ratio. Correlate process creation with traffic volume toward services such as Dropbox, Google Drive and OneDrive.
- Linux:
tar,curlor python scripts reading large file sets and sending HTTPS POST requests with payload sizes that do not fit the baseline. The sequence of archive then encrypted upload is the signal. - macOS: Office apps or scripts writing files, then manipulating extended attributes to evade quarantine, then uploading over HTTPS from apps that are not network apps, such as Word, Excel or Preview.
- SaaS and Office Suite: unusual API calls from user accounts invoking file upload endpoints, outside normal baselines, in services such as Microsoft 365, Google Drive and Box. Watch unified audit logs for a higher frequency of Upload, Create or Copy operations from a compromised account.
- ESXi: guest OS or management interface processes opening unexpected external HTTPS connections, especially vmx or hostd with significant data transfer.
The thread is baselines. Know what normal upload volume looks like for each user, each server and each service account. Without it, every alert is a debate.
How to reduce the risk
MITRE lists two mitigations.
- Restrict Web-Based Content. Use web proxies to enforce an external network communication policy that prevents use of unauthorized external services.
- Data Loss Prevention. DLP can detect and block sensitive data being uploaded to web services through web browsers.
Think of these as layers. The proxy decides which services your people and servers can reach at all. DLP looks inside what goes to the services you do allow. Monitoring catches what both miss.
Check your own environment
Work through a short list.
- Which web services can a production server reach? Many should reach none, or a short allowlist.
- Can you separate corporate and personal tenants of the same service in logs?
- Do you have per-host and per-user outbound volume baselines, and an alert for a large deviation?
- Is the audit log of your productivity suite switched on and retained, including upload and copy events?
- On Linux, which hosts have tools such as curl and rclone installed that do not need them?
A read-only look at who is making outbound connections right now on a Linux host:
ss -tnp state established
Review the processes and remote addresses and ask whether each belongs.
Triage when an alert fires
Start with the process and its parent. Then find what it read just before: file access in sensitive folders is the strongest hint. Then check the volume against baseline, the destination account where you can see it, and any compression step. Finally, decide whether the user or the service account was acting on its own, which points you to either a policy conversation or an incident.
Why subtechniques matter
Each destination has a different control. A code repository is best handled with an allowlist of organizations. Cloud storage needs tenant controls. Text sites can often be blocked outright for servers. Webhooks need a review of what is configured in your own SaaS tools. Handle them as four related controls, not one.
Quick check
Why does this technique blend in with normal traffic?
It uses popular services that hosts already contact, firewall rules often already allow them, and TLS hides the content.
What is the key detection signal on the source host?
A process that does not normally use the network, or that has just read many files, sending a large HTTPS upload.
Which two mitigations does MITRE list?
Restrict Web-Based Content through web proxies, and Data Loss Prevention for browser uploads.
