MITRE ATT&CK - Técnica

T1567.004: Exfiltration Over Webhook

Exfiltration Over Webhook (T1567.004) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1567.004 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Exfiltration Over Webhook deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Exfiltration. As plataformas mapeadas pela MITRE incluem ESXi, Linux, macOS, Office Suite, SaaS e Windows. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Exfiltration
Plataformas MITRE ESXi, Linux, macOS, Office Suite, SaaS, Windows

Descrição oficial original do MITRE ATT&CK

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and webhook.site, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello. When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated Automated Exfiltration of emails, chat messages, and other data. Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it. Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.

Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Exfiltration Over Webhook automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma