Techniques › T1029
T1029 Scheduled Transfer
exfiltration — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1029
0
KEV CVEs mapped here
<p>Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.</p><p>When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0399 Detection Strategy for Scheduled Transfer and Recurrent Exfiltration Patterns v1.0
AN1118 WindowsRecurring network exfiltration initiated by scheduled or script-based processes exhibiting time-based regularity and consistent external destinations.Tunable:
TimeWindowDestIPAllowlistParentProcessBaselineAN1119 LinuxDetection of cron-based or script-based recurring transfers where the same script, user, or destination reappears at predictable intervals.Tunable:ScriptPathRegexCronIntervalThresholdExfilUserContextAN1120 macOSLaunchAgent or launchd recurring jobs initiating data transfer to consistent external IPs or domains with repeat timing signatures.Tunable:AgentPathPatternsRepeatIntervalDeltaUserHomeJobs
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1029
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.