Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1567.004 Exfiltration Over Webhook · cyberstrikeus | DecimalAI

cyberstrikeus/T1567.004_exfiltration-over-webhook

SkillScore91Maintained

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1567.004

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1567-004-exfiltration-over-webhook/SKILL.md

decimalai skills pull cyberstrikeus-t1567-004-exfiltration-over-webhook --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1567-004-exfiltration-over-webhook/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1567-004-exfiltration-over-webhook/SKILL.md

Raw file: /s/cyberstrikeus-t1567-004-exfiltration-over-webhook/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1567-004-exfiltration-over-webhook.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +14% lift+14% tokens0% turns91% of whole cases pass with skill (20/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-05	✗→✓	▲ Improved	1%	0%
case-06	✗→✓	▲ Improved	0%	0%
case-13	✗→✓	▲ Improved	-24%	0%
case-03	✓→✓	＝ Same ✓	6%	0%
case-22	✓→✓	＝ Same ✓	35%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0010_exfiltration/T1567.004_exfiltration-over-webhook/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1567.004 Exfiltration Over Webhook

> Sub-technique of: T1567

High-Level Description

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and webhook.site, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello. When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.

Adversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated Automated Exfiltration of emails, chat messages, and other data. Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.

Access to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.

Kill Chain Phase

Exfiltration (TA0010)

Platforms: Windows, macOS, Linux, SaaS, Office Suite, ESXi

What to Check

] Identify if Exfiltration Over Webhook technique is applicable to target environment
] Check Windows systems for indicators of Exfiltration Over Webhook
] Check macOS systems for indicators of Exfiltration Over Webhook
] Check Linux systems for indicators of Exfiltration Over Webhook
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Exfiltration Over Webhook by examining the target platforms (Windows, macOS, Linux).

Assess Existing Defenses: Review whether mitigations for T1567.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1057 Data Loss Prevention

Data loss prevention can be detect and block sensitive data being uploaded to web services via web browsers.

Detection

Detection Strategy for Exfiltration Over Webhook

Risk Assessment

| Finding | Severity | Impact | | ---------------------------------------------- | -------- | ------------ | | Exfiltration Over Webhook technique applicable | Low | Exfiltration |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-200 | Exposure of Sensitive Information |

References

Illustrative Want to see what cyberstrikeus/T1567.004_exfiltration-over-webhook would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 20:18 UTC · 22 cases

Lift

+14%

91% vs 77%

Agent turns

0%

1.0 vs 1.0

Tokens

+14%

2,640.09 vs 2,311

fail → pass · 3pass → pass · 17fail → fail · 2

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We are conducting a security review of our cloud collaboration tools and workstation fleets to see if attackers could steal sensitive files using outbound webhook connections. Could you generate an audit checklist and remediation guidance for MITRE ATT&CK technique T1567.004? Please cover what platforms to inspect, how manual testing should be structured, and what data loss prevention measures can help block unauthorized web service uploads.	fail→fail	36,429	30,410	-17%	1	1	0%	4,271	5,290	+24%	0	0	—
case-02 Our incident response team is assessing vectors where attackers misuse automated HTTP push notifications or messaging webhooks to siphon corporate data. Please provide an analysis of the T1567.004 exfiltration technique, outlining the overall kill chain phase, potential target platforms, manual verification procedures, and risk evaluation findings for our environment.	fail→fail	29,843	30,235	+1%	1	1	0%	3,505	5,323	+52%	0	0	—
case-03 When evaluating MITRE ATT&CK T1567.004 for enterprise virtualization and enterprise office software, security analysts often focus only on standard operating systems like Windows and Linux. What non-standard enterprise platforms must also be included in the scope of T1567.004 assessments?	pass→pass	25,419	15,825	-38%	1	1	0%	2,703	2,870	+6%	0	0	—
case-22 An incident response report indicates an attacker sent proprietary files back through an established Empire C2 agent connection over custom TCP protocols (ATT&CK T1041). How does T1041 differ from exfiltration over third-party web services, and what are the primary detection mechanisms for command-and-control exfiltration?	pass→pass	25,217	23,540	-7%	1	1	0%	2,914	3,925	+35%	0	0	—
case-04 A threat hunter is writing a defense recommendation report for preventing unauthorized outbound HTTP POST requests to webhook endpoints like Discord or Slack. What specific MITRE ATT&CK mitigation ID addresses blocking sensitive uploads to web services via web browsers?	pass→pass	21,434	7,703	-64%	1	1	0%	3,060	1,518	-50%	0	0	—
case-05 A purple team operator wants to run pre-built automated emulation scripts from Atomic Red Team to test T1567.004 exfiltration in a sandbox environment. What should the team know regarding current Atomic Red Team coverage for T1567.004?	fail→pass	57,912	8,602	-85%	1	1	0%	2,579	2,596	+1%	0	0	—
case-06 In an enterprise risk matrix evaluation for technique T1567.004 (Exfiltration Over Webhook), junior analysts proposed marking the intrinsic risk severity as High due to the potential for data loss. What severity level does standard ATT&CK risk assessment assign to the presence/applicability of this technique?	fail→pass	15,744	9,256	-41%	1	1	0%	1,625	1,630	+0%	0	0	—
case-07 To structure an alert triage rule in a SIEM, an analyst needs to map T1567.004 to its corresponding MITRE ATT&CK tactic phase and tactic ID. What tactic name and tactic ID correspond to this sub-technique?	pass→pass	9,342	6,900	-26%	1	1	0%	646	1,383	+114%	0	0	—
case-08 A vulnerability manager is mapping ATT&CK technique T1567.004 to Common Weakness Enumeration (CWE) standards for executive reporting. Which specific CWE identifier maps to Exfiltration Over Webhook?	pass→pass	17,348	7,778	-55%	1	1	0%	2,078	1,461	-30%	0	0	—
case-09 An incident handler is categorizing an alert for webhook-based data transfer in an endpoint detection rule. What is the parent ATT&CK technique ID for T1567.004?	pass→pass	2,140	6,894	+222%	1	1	0%	399	1,381	+246%	0	0	—
case-10 When evaluating cloud collaboration security, an engineer suggests that webhook exfiltration only affects desktop OS hosts. Which cloud-hosted platform category must be explicitly inspected for T1567.004 scope?	pass→pass	8,971	4,801	-46%	1	1	0%	1,458	1,702	+17%	0	0	—
case-11 A penetration tester is outlining a manual evaluation procedure for webhook exfiltration vulnerabilities across target assets. What is the initial step required before testing technical execution?	pass→pass	14,274	9,508	-33%	1	1	0%	1,142	1,627	+42%	0	0	—
case-12 An enterprise web gateway administrator asks how Data Loss Prevention (DLP) controls mitigate webhook-based exfiltration. What specific browser-level mechanism does DLP use for this threat?	pass→pass	22,749	16,227	-29%	1	1	0%	2,648	2,763	+4%	0	0	—
case-13 In a risk assessment table for T1567.004 applicability, what specific impact category is listed for the finding that Exfiltration Over Webhook is applicable?	fail→pass	9,786	6,452	-34%	1	1	0%	1,668	1,276	-24%	0	0	—
case-14 A SOC manager is setting up asset tagging rules for endpoint auditing on T1567.004. Which three traditional workstation and server operating system platforms need to be checked?	pass→pass	10,696	2,679	-75%	1	1	0%	796	1,422	+79%	0	0	—
case-15 An analyst is documenting threat vectors where adversaries misuse public webhooks for data transfer. Which common messaging and collaboration services supporting webhooks should be listed as potential endpoints?	pass→pass	21,502	14,167	-34%	1	1	0%	2,625	2,622	-0%	0	0	—
case-16 During a manual assessment of T1567.004, after identifying the attack surface, what action should the assessor perform before executing test traffic?	pass→pass	16,823	2,137	-87%	1	1	0%	1,796	1,483	-17%	0	0	—
case-17 An analyst asks how adversaries bypass automated SaaS integration when using webhooks for data extraction. Besides linking SaaS triggers, what alternative manual method do adversaries use with webhook endpoints?	pass→pass	15,714	10,164	-35%	1	1	0%	2,359	1,870	-21%	0	0	—
case-18 An auditor is creating a checklist for T1567.004 compliance. What specific verification checks must be included across endpoint operating systems?	pass→pass	24,672	22,486	-9%	1	1	0%	3,307	3,941	+19%	0	0	—
case-19 A detection engineer is evaluating threat coverage for webhook exfiltration. How many distinct detection strategies are specified for T1567.004 coverage in standard guidance?	pass→pass	19,170	7,754	-60%	1	1	0%	2,676	1,550	-42%	0	0	—
case-20 Our security team is assessing data exfiltration to Amazon S3 buckets and Google Drive folders under MITRE ATT&CK technique T1567.002. Please provide the specific sub-technique details, detection strategies, and mitigation steps for T1567.002 Cloud Storage exfiltration.	pass→pass	20,501	33,401	+63%	1	1	0%	3,778	6,287	+66%	0	0	—
case-21 We are developing a web application that receives incoming webhooks from GitHub. How should our software development team implement HMAC SHA-256 signature verification in Node.js to validate that incoming HTTP payloads originate from GitHub?	pass→pass	19,185	17,087	-11%	1	1	0%	2,809	4,162	+48%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 77.3%
Pass rate with the skill: 90.9%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 20:18 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-05

Prompt

A purple team operator wants to run pre-built automated emulation scripts from Atomic Red Team to test T1567.004 exfiltration in a sandbox environment. What should the team know regarding current Atomic Red Team coverage for T1567.004?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run91

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+13% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 23 days ago

Other measured skills in the registry, with their headline benchmark lift.