Windows DataSvcUtil.exe Command-Line Exfiltration Using /in:, /out:, and /uri:

Alerts on DataSvcUtil.exe runs with /in:, /out:, and /uri: parameters that may indicate data exfiltration activity.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-09-30
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1567Exfiltration Over Web Service
Impact

What it detects

This rule identifies potential data exfiltration activity when DataSvcUtil.exe is executed with command-line parameters indicating input (/in:), output (/out:), and a service endpoint (/uri:). Such usage can be abused to collect or marshal data from a targeted source and then write it to an output location for transfer. The detection relies on Windows process creation telemetry, specifically the executable image and command-line contents.

Reporting behind it

Related detections9 linkedT1567 — drag to rearrange

Malicious Destructive Recursive Delete of Home Directory

Malicious Madgicx Plus Extension C2 Domain Resolution

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious HTTP POST to Local AI Malware Exfil Endpoint (via proxy)

Malicious Mini Shai-Hulud TanStack C2 git-tanstack and getsession (via dns_query)

Suspicious Data Exfiltration to Webhook.site via Command Line (via process_creation)

Malicious GitHub Repository Creation With s1ngularity Exfiltration Name

Suspicious SNS Email Subscription for Data Exfiltration

Suspicious Azure OpenAI Training File Upload via Files Import Operation (via azure)

Windows DataSvcUtil.exe Command-Line Exfiltration Using /in:, /out:, and /uri:

Pivot detection · T1567 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-data-exfiltration-via-datasvcutil-exe-with-in-out-uri-arguments-e290b10b

title: "Windows DataSvcUtil.exe Command-Line Exfiltration Using /in:, /out:, and /uri:"
id: 29bef1af-7768-452b-a9c6-2811d52a6607
status: test
description: This rule identifies potential data exfiltration activity when DataSvcUtil.exe is executed with command-line parameters indicating input (/in:), output (/out:), and a service endpoint (/uri:). Such usage can be abused to collect or marshal data from a targeted source and then write it to an output location for transfer. The detection relies on Windows process creation telemetry, specifically the executable image and command-line contents.
references:
  - https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services
  - https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml
author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger, Huntrule Team
date: 2021-09-30
modified: 2022-05-16
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli:
    CommandLine|contains:
      - "/in:"
      - "/out:"
      - "/uri:"
  selection_img:
    - Image|endswith: \DataSvcUtil.exe
    - OriginalFileName: DataSvcUtil.exe
  condition: all of selection*
falsepositives:
  - DataSvcUtil.exe being used may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: e290b10b-1023-4452-a4a9-eb31a9013b3a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL