T1567.001 Exfiltration to Code Repository

exfiltration — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1567.001

KEV CVEs mapped here

<p>Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.</p><p>Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0318 Detection Strategy for Exfiltration to Code Repository v1.0
AN0895 Windows
Processes such as PowerShell, Git, or curl initiating outbound HTTPS POST requests to known code repository APIs (e.g., github.com, gitlab.com) immediately following large file reads. Defender view: correlation between file access of sensitive directories (e.g., Documents, Finance) and abnormal data uploads to repository domains.

WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: MonitoredDomains ExfilVolumeThreshold

AN0896 Linux
Processes like git, curl, or python scripts executing commands that package files (tar, gzip) followed by HTTPS uploads to code repository endpoints. Defender view: detect unusual git push activity or scripted HTTPS requests outside normal developer work hours.

auditd:EXECVE git push, curl -X POST → DC0064 Command Execution
auditd:SYSCALL open/read of sensitive directories → DC0055 File Access
NSM:Flow large outbound HTTPS uploads to repo domains → DC0078 Network Traffic Flow

Tunable: WorkHours RepoDomainList

AN0897 macOS
Office or scripting applications initiating unusual HTTPS traffic to code repository APIs with high outbound-to-inbound ratios. Defender perspective: monitor for sensitive file access in combination with network connections to github.com, gitlab.com, or bitbucket.org.

macos:unifiedlog execution of curl, git, or Office processes with network connections → DC0032 Process Creation
macos:unifiedlog read of user document directories → DC0055 File Access
macos:unifiedlog outbound HTTPS connections to code repository APIs → DC0085 Network Traffic Content

Tunable: MonitoredApplications

AN0898 ESXi
ESXi host processes (vmx, hostd) initiating HTTPS sessions toward external code repositories. Defender perspective: detect datastore reads followed by outbound web traffic inconsistent with administrative baselines.

esxi:hostd datastore file access → DC0055 File Access
esxi:vmkernel HTTPS traffic to repository domains → DC0078 Network Traffic Flow

Tunable: DatastoreTransferThreshold

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1567.001`

GitHub Repository Pages Site Changed to Public lowexperimental

Author: Ivan Saakov · 2025-10-18 · logsource: product=github service=audit · 0c46d4f4-a2bf-4104-9597-8d653fc2bb55

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

Techniques: T1567.001

Network Connection Initiated To DevTunnels Domain mediumtest

Author: Kamran Saifullah · 2023-11-20 · logsource: product=windows category=network_connection · 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1567.001 T1572

Rules tagged at the parent level (attack.t1567) 12

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Process Initiated Network Connection To Ngrok Domain hightest

Author: Florian Roth (Nextron Systems) · 2022-07-16 (modified 2025-07-30) · logsource: product=windows category=network_connection · 18249279-932f-45e2-b37a-8925f2597670

Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Techniques: T1567 T1572 T1102

Communication To Ngrok Tunneling Service - Linux hightest

Author: Florian Roth (Nextron Systems) · 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Techniques: T1567 T1568.002 T1572 T1090 T1102

Communication To Ngrok Tunneling Service Initiated hightest

Author: Florian Roth (Nextron Systems) · 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849

Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.

Techniques: T1567 T1568.002 T1572 T1090 T1102

Arbitrary File Download Via ConfigSecurityPolicy.EXE mediumtest

Author: frack113 · 2021-11-26 (modified 2022-05-16) · logsource: product=windows category=process_creation · 1f0f6176-6482-4027-b151-00071af39d7e

Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. Users can configure different pilot collections for each of the co-management workloads. It can be abused by attackers in order to upload or download files.

Techniques: T1567

Network Connection Initiated To Visual Studio Code Tunnels Domain mediumtest

Author: Kamran Saifullah · 2023-11-20 · logsource: product=windows category=network_connection · 4b657234-038e-4ad5-997c-4be42340bce4

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1567 T1572

Network Connection Initiated To Cloudflared Tunnels Domains mediumtest

Author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems) · 2024-05-27 · logsource: product=windows category=network_connection · 7cd1dcdc-6edf-4896-86dc-d1f19ad64903

Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1567 T1572

Network Connection Initiated To BTunnels Domains mediumtest

Author: Kamran Saifullah · 2024-09-13 · logsource: product=windows category=network_connection · 9e02c8ec-02b9-43e8-81eb-34a475ba7965

Detects network connections to BTunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Techniques: T1567 T1572

Monero Crypto Coin Mining Pool Lookup highstable

Author: Florian Roth (Nextron Systems) · 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641

Detects suspicious DNS queries to Monero mining pools

Techniques: T1496 T1567

Suspicious Non-Browser Network Communication With Telegram API mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875

Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2

Techniques: T1102 T1567 T1105

LOLBAS Data Exfiltration by DataSvcUtil.exe mediumtest

Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger · 2021-09-30 (modified 2022-05-16) · logsource: product=windows category=process_creation · e290b10b-1023-4452-a4a9-eb31a9013b3a

Detects when a user performs data exfiltration by using DataSvcUtil.exe

Techniques: T1567

T1567.001 Exfiltration to Code Repository

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1567.001

Rules tagged at the parent level (attack.t1567) 12

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1567.001`