Exfiltration via Collaboration Platform

A subject uses a cloud collaboration platform, such as Slack, Google Docs, Atlassian Confluence, or Microsoft 365 Online, to exfiltrate data. They will then access that service again on another device to retrieve the data. Examples include (URLs have been sanitized):

• hxxps://docs.google[.]com
  hxxps://*.slack[.]com (* represents a wildcard, where a workspace name would be present)
  hxxps://word.cloud[.]microsoft
  hxxps://excel.cloud[.]Microsoft
• hxxps://powerpoint.cloud[.]Microsoft
• hxxps://*.atlassian[.]net/wiki/ (* represents a wildcard, where a workspace name would be present)