Detecting Exfiltration over Webhooks and Paste Sites

A webhook accepts an HTTPS POST and delivers it to a chat channel. That makes Discord, Slack and Telegram convenient drop points for credential stealers and small-scale exfiltration. The endpoints have recognisable URL structures, and in most corporate environments nothing but a browser or a sanctioned integration should be calling them.

Signals at a Glance

Endpoint URL Patterns

Webhook URLs follow fixed structures, which makes them one of the more precise network detections. Match the path as well as the host, and require a POST, since a user reading a Discord link in a browser is not exfiltration:

title: Webhook Or Paste Service Upload From Non-Browser Client
logsource:
  category: proxy
detection:
  webhook:
    c-uri|contains:
      - 'discord.com/api/webhooks/'
      - 'discordapp.com/api/webhooks/'
      - 'hooks.slack.com/services/'
      - 'api.telegram.org/bot'
      - 'pastebin.com/api/api_post.php'
      - 'webhook.site/'
      - 'requestbin'
  method:
    cs-method: 'POST'
  filter_browser:
    c-useragent|contains: 'Chrome/'
  condition: webhook and method and not filter_browser
level: medium
# tune/validate: allowlist CI/CD and monitoring integrations by source host

Endpoint telemetry tells you which process made the call, which the proxy cannot. A PowerShell session or a binary in a user profile talking to a webhook is a high-quality lead:

// Microsoft Defender XDR (KQL) - webhook or paste endpoints from non-browser processes
// tune/validate: extend the allowlist with sanctioned chat clients
let ok = dynamic(["chrome.exe","msedge.exe","firefox.exe","discord.exe","slack.exe","teams.exe","ms-teams.exe"]);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("discord.com","discordapp.com","hooks.slack.com","api.telegram.org","pastebin.com","webhook.site","transfer.sh")
| where InitiatingProcessFileName !in~ (ok)
| summarize conns = count(), firstSeen = min(Timestamp), lastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl
| order by conns desc

Triage and Policy

• If your organisation does not use Discord or Telegram, block the domains outright; it removes the channel and turns every attempt into a high-confidence alert.
• A webhook URL embeds the secret. When you capture one in logs or a sample, report it to the platform so the webhook can be revoked.
• Check the process lineage: infostealers typically execute from a download or a malicious attachment, then post once and exit.
• For Slack and Teams, inventory approved incoming webhooks centrally so anything outside the list stands out.