Automated Exfiltration (T1020) is an exfiltration technique. Adversaries use automated processing to move data out after it has been gathered during collection. MITRE lists Linux, macOS, network devices and Windows.
How attackers use it
MITRE notes that when automated exfiltration is used, other exfiltration techniques likely apply as well to move the data out of the network, such as exfiltration over the C2 channel and exfiltration over an alternative protocol. So this technique is often the scheduling layer on top of another one. A script runs on a timer and ships whatever has accumulated.
For defenders, the timer is the giveaway. People do not send data out at the same minute every hour.
How to detect it
MITRE's analytic looks for periodic transfers set up through persistence mechanisms:
- Automated tools or scripts that regularly transmit data to external destinations using scheduled tasks or background processes.
- Linux: background scripts, for example through cron, or daemons that send data again and again to remote addresses or URLs.
- macOS: LaunchAgents or LaunchDaemons that make periodic external connections that look like automated data transfer.
Two approaches work together. First, review scheduled tasks, cron entries and launch items for jobs that make outbound connections and that you did not create. Second, look at flow data for regularity. A beacon-like pattern with steady intervals and similar transfer sizes to one destination stands out, especially from a server.
How to reduce the risk
MITRE lists no mitigations for this technique itself. Controls that stop the transfers it relies on apply, and the related techniques list egress filtering, encryption and data loss prevention. In practice:
- Default deny outbound traffic from servers, with allowlisted destinations.
- Inventory scheduled tasks and cron jobs, and alert on new ones on servers.
- Use data loss prevention to watch for sensitive data leaving.
What to look for in the schedule
Persistence and automation are two sides of the same coin here. For automated exfiltration to work, something has to run repeatedly. That something sits in a scheduler: a scheduled task on Windows, cron on Linux, a launch agent or daemon on macOS. Each of those is a list you can review.
Make the review routine:
- Export scheduled tasks, cron entries and launch items from servers weekly.
- Compare against the previous export.
- Investigate new entries that run scripts from user, temp or hidden folders, or that call network tools.
New scheduled items on production servers should come with a change ticket. A new task with no ticket is the finding.
Reading flow data for rhythm
Beacons and automated transfers have rhythm. Group outbound flows by source and destination, then look at the spacing between connections. Highly regular spacing, with similar sizes each time, is unusual for human activity. Some legitimate services also behave this way, such as update checks and monitoring agents, so keep an allowlist and look at what is left.
Limit the outbound paths
The most effective mitigation is to reduce where automated jobs can send data. Servers that can reach only a short list of destinations cannot ship anything elsewhere, however well the job is scheduled. Pair that with data loss prevention at the places where sensitive data leaves, and with an inventory of the destinations your business really uses.
Check your own environment
List cron jobs for the current user and the system cron directory on a Linux host (read-only):
crontab -l
ls -l /etc/cron.d
On Windows, list scheduled tasks from a command prompt (schtasks, read-only):
schtasks /query /fo LIST
Look for tasks that run scripts from user or temp folders.
Quick check
What gives automated exfiltration away in flow data?
Regular intervals and similar transfer sizes to a single destination, typically from a scheduled task or background process.
