Use an existing, legitimate external web service to move data from a compromised host instead of using a primary command-and-control channel. T1567 is the parent technique; its sub-techniques distinguish code repositories, cloud storage, text storage sites, and webhooks. An arbitrary HTTPS POST alone does not establish this technique.
Requirements: none specified (operational prerequisites may still apply)
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
Dropbox · Create Password-Protected Archive
Create Password-Protected Archive
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: none specified (operational prerequisites may still apply)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.Shell: RESTRICTED_ACCESS_BLUR_MARKER. Privileges: not documented.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER