Exfiltration Over Webhook
Subtechnique · ATTACK:enterprise:T1567.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1567.004",
"title": "Exfiltration Over Webhook",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1567/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--43f2776f-b4bd-4118-94b8-fee47e69676d",
"external_id": "T1567.004",
"domain": "enterprise",
"created": "2023-07-20T15:30:55.763Z",
"modified": "2026-05-12T15:12:00.629Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"exfiltration"
],
"source_references": [
{
"source_name": "Checkmarx Webhooks",
"url": "https://medium.com/checkmarx-security/webhook-party-malicious-packages-caught-exfiltrating-data-via-legit-webhook-services-6e046b07d191"
},
{
"source_name": "CyberArk Labs Discord",
"url": "https://www.cyberark.com/resources/threat-research-blog/the-not-so-secret-war-on-discord"
},
{
"source_name": "Discord Intro to Webhooks",
"url": "https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks"
},
{
"source_name": "Microsoft SQL Server",
"url": "https://www.microsoft.com/security/blog/2023/10/03/defending-new-vectors-threat-actors-attempt-sql-server-to-cloud-lateral-movement/"
},
{
"source_name": "Talos Discord Webhook Abuse",
"url": "https://blog.talosintelligence.com/collab-app-abuse/"
},
{
"source_name": "Push Security SaaS Attacks Repository Webhooks",
"url": "https://github.com/pushsecurity/saas-attacks/blob/main/techniques/webhooks/description.md"
},
{
"source_name": "RedHat Webhooks",
"url": "https://www.redhat.com/en/topics/automation/what-is-a-webhook"
}
]
}Explicit source assertions (4)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1567.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--366db351-db4d-4576-857e-10857c2188c5
CERT PolskaATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1567.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9ab02df-8812-4351-956a-00d1cf947778
Wiz Shai-Hulud September 2025ATTACK:enterprise:M1057 → mitigates → ATTACK:enterprise:T1567.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e460fd2b-6093-4700-a4a9-3bdea5297bdf
ATTACK:enterprise:T1567.004 → subtechnique-of → ATTACK:enterprise:T1567
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1793a83-f51c-48d4-b11e-ee9c93a28e71