Exfiltration over webhooks

SCM Posture CI/CD Posture

A Webhook attack is a technique used by threat actors to gain unauthorized access to a target's web application and exfiltrate data from it.
In this type of attack, the attacker gains access to the victim's web application and installs a malicious webhook, which is a piece of code that is executed whenever a specific event occurs on the web application.
The webhook is designed to exfiltrate data from the victim's web application and transmit it to a remote server controlled by the attacker.
The data exfiltrated can include sensitive information such as user credentials, customer data, or financial information.
Webhook attacks can be used to bypass outbound traffic control because the exfiltrated data is transmitted through legitimate channels that are often used by the web application.
This makes it difficult for traditional network security tools to detect the exfiltration of data.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below.

Mitigations

M1550 Implement strict access control for clouds
M1560 Regularly audit webhooks
M1561 Monitor outbound traffic
M1562 Implement access controls for webhooks
M1563 Use data encryption for webhooks

Detections

D1510 Implement Intrusion Detection System and anti-malware
D1520 Implement endpoint detection and response system
D1590 Implement continuous monitoring and logging of the CI/CD process

Exfiltration over webhooks

Where this idea came from

Mitigations

Detections

Observed in incidents (8)

References