---
{
  "title": "Exfiltration Over Web Service",
  "summary": "Web-service exfiltration transfers data through a legitimate online provider.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1567"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1567: Exfiltration Over Web Service",
      "url": "https://attack.mitre.org/techniques/T1567"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Web-service exfiltration transfers data through a legitimate online provider. The specific account, resource, and data boundary matter more than the provider's general reputation.


## An investigation example

A suspicious process uploads collected files to a cloud collaboration resource outside the organization.

## Evidence to examine

Review process ownership, destination resource identifiers, file staging, identity grants, and cumulative transfers.

## A common analytical pitfall

A familiar cloud service can host an unapproved destination; provider legitimacy is not transfer authorization.

## Response considerations

Stop confirmed unauthorized uploads and scope the data and recipient resources using available endpoint and provider evidence.


## A legitimate platform can host an unauthorized destination

Web services support ordinary uploads, collaboration, and storage. An intruder may use the same capabilities to move information outside the intended boundary. Trusting the provider's brand or domain is insufficient: the receiving account, workspace, or repository may belong to somebody else. Evaluate the specific destination and authorized purpose.

Network records may show an upload or substantial outbound traffic without revealing the transferred content. Endpoint file access, browser context, application audit events, and service records can add detail. A request to a popular service does not automatically prove data loss, while an encrypted connection does not make the destination trustworthy.

## A fictional unapproved upload

An academy sees a staff device upload an archive to a personal collaboration workspace shortly after reading restricted files. Analysts correlate file creation, process activity, account context, and the destination. The archive name alone does not prove its contents, so the report identifies which evidence supports the assessed exposure.

Containment may include restricting the session or sharing path, but coordinate with business owners because the same service may support legitimate work. Review approved destinations and data-handling expectations rather than blocking every use of a platform without understanding the operational effect. Preserve relevant records before retention windows expire.

## Separate provider from recipient

Create fictional examples of an approved organizational workspace and an unapproved personal workspace on the same provider. Identify the records that distinguish them. Then write the evidence needed to claim that particular files were uploaded successfully, not merely that a connection occurred.

Response should also examine how the initiating identity obtained access to the data. Removing the upload destination alone may leave the original account compromise or excessive permissions unresolved. A complete assessment connects collection, packaging, transfer, and recipient context only where the evidence supports those stages.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]