type: attack-pattern
spec_version: 2.1
id: attack-pattern--43f2776f-b4bd-4118-94b8-fee47e69676d
created: 2023-07-20T15:30:55.763Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1567/004
external_id: T1567.004
source_name: Checkmarx Webhooks
description:  Jossef Harush Kadouri. (2022, March 7). Webhook Party — Malicious packages caught exfiltrating data via legit webhook services. Retrieved July 20, 2023.
url: https://medium.com/checkmarx-security/webhook-party-malicious-packages-caught-exfiltrating-data-via-legit-webhook-services-6e046b07d191
source_name: CyberArk Labs Discord
description: CyberArk Labs. (2023, April 13). The (Not so) Secret War on Discord. Retrieved July 20, 2023.
url: https://www.cyberark.com/resources/threat-research-blog/the-not-so-secret-war-on-discord
source_name: Discord Intro to Webhooks
description: D. (n.d.). Intro to Webhooks. Retrieved July 20, 2023.
url: https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks
source_name: Microsoft SQL Server
description: Microsoft Threat Intelligence. (2023, October 3). Defending new vectors: Threat actors attempt SQL Server to cloud lateral movement. Retrieved October 3, 2023.
url: https://www.microsoft.com/security/blog/2023/10/03/defending-new-vectors-threat-actors-attempt-sql-server-to-cloud-lateral-movement/
source_name: Talos Discord Webhook Abuse
description: Nick Biasini, Edmund Brumaghin, Chris Neal, and Paul Eubanks. (2021, April 7). https://blog.talosintelligence.com/collab-app-abuse/. Retrieved July 20, 2023.
url: https://blog.talosintelligence.com/collab-app-abuse/
source_name: Push Security SaaS Attacks Repository Webhooks
description: Push Security. (2023, July 31). Webhooks. Retrieved August 4, 2023.
url: https://github.com/pushsecurity/saas-attacks/blob/main/techniques/webhooks/description.md
source_name: RedHat Webhooks
description: RedHat. (2022, June 1). What is a webhook?. Retrieved July 20, 2023.
url: https://www.redhat.com/en/topics/automation/what-is-a-webhook
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T19:58:26.901Z
name: Exfiltration Over Webhook
description: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. 

Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server)

Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: exfiltration
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Yossi Weizman, Microsoft Threat Intelligence
Sunders Bruskin, Microsoft Threat Intelligence
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
macOS
Linux
SaaS
Office Suite
ESXi
x_mitre_version: 1.2