Exfiltration Over Web Service: Exfiltration to Code Repository
- ID
- T1567.001
- Tactics
- TA0010 Exfiltration
- Sub-technique of
- T1567 Exfiltration Over Web Service
- Platforms
- ESXi, Linux, macOS, Windows
- Data sources
- File Access, Network Connection Creation, Process Creation, Command Execution, Network Traffic Flow, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.
Detection
- DET0318 Detection Strategy for Exfiltration to Code Repository
Data components: File Access, Network Connection Creation, Process Creation, Command Execution, Network Traffic Flow, Network Traffic Content
Mitigations (1)
- M1021 Restrict Web-Based Content
Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.