Wiki › Techniques, Tactics & Procedures (TTPs) › Exfiltration › Scheduled Data Exfiltration

Scheduled Data Exfiltration

2 min read

Jump to:

Overview

Scheduled Data Exfiltration is a technique where adversaries automate the unauthorized transfer of data at predetermined intervals or times to avoid detection. This method enables attackers to stealthily extract sensitive information over extended periods, often bypassing real-time monitoring systems by blending with normal network activity.

Attack Objective

The primary goal is data theft through covert and sustained extraction.
It supports the Exfiltration stage of the attack lifecycle.
Advances the attacker’s position by enabling continuous data collection while minimizing the risk of triggering alerts or suspicion.

How the Technique Works

Adversaries configure automated processes or scripts to transfer collected data at specific times or intervals, often during low-visibility periods such as off-hours or maintenance windows. This scheduling can be implemented using native operating system task schedulers, cron jobs, or cloud-based automation tools. By controlling the timing and volume of data exfiltration, attackers reduce the likelihood of detection by security monitoring systems.

Common Methods & Variations

Use of operating system task schedulers (e.g., Windows Task Scheduler, cron) to automate data transfer.
Cloud environments leveraging scheduled functions or serverless computing to exfiltrate data.
Identity-based scheduling where compromised credentials trigger data movement at set times.
Living-off-the-land techniques employing legitimate system tools (e.g., PowerShell, curl, wget) versus custom exfiltration tools.

Indicators of Compromise (IOCs)

Unusual or unauthorized scheduled tasks or cron jobs.
Network traffic spikes correlating with scheduled times, especially to external or suspicious destinations.
Logs showing repeated data access followed by outbound connections at regular intervals.
Authentication events tied to scheduled activities using compromised credentials.

Detection Strategies

Monitoring task scheduler logs and configurations for unauthorized or anomalous entries.
Behavioral analytics to identify periodic data transfers inconsistent with normal user or system behavior.
Correlation of file access patterns with outbound network connections occurring on a schedule.
Use of network flow data and endpoint telemetry to detect recurring data exfiltration attempts.

Mitigation & Prevention

Restrict permissions to create or modify scheduled tasks and automate processes.
Implement strict network egress controls and data loss prevention (DLP) policies.
Enforce multi-factor authentication and monitor for credential misuse.
Regularly audit scheduled tasks and automation configurations across endpoints and cloud environments.

Response Considerations

Immediately disable or quarantine suspicious scheduled tasks or automation scripts.
Investigate the scope of data accessed and exfiltrated during scheduled intervals.
Review and revoke compromised credentials and strengthen identity controls.
Harden system configurations to prevent unauthorized task creation and improve monitoring coverage.

Related Techniques

Data Staged: Preparation of data prior to exfiltration.
Command and Control: Channels used to facilitate data transfer.
Credential Access: Often a prerequisite to establish scheduled exfiltration.
Defense Evasion: Techniques to hide scheduled tasks or obfuscate exfiltration methods.

Mapping & References

MITRE ATT&CK Tactic: Exfiltration
MITRE ATT&CK Technique: Scheduled Transfer (T1029)
Public research on scheduled exfiltration patterns and detection methodologies from cybersecurity vendors and incident reports.

Tags: Attack Lifecycle Cybersecurity data theft Detection endpoint security Exfiltration Mitigation network security Scheduled Tasks threat intelligence