Detecting and Mitigating Scheduled Transfer Exfiltration (T1029)

Data theft does not have to be loud. If an adversary sends data out at certain times of day, or at steady intervals, the traffic can hide inside normal patterns and business hours.

MITRE tracks this as Scheduled Transfer, technique T1029, in the Exfiltration tactic. It applies to Linux, macOS and Windows.

How attackers use it

MITRE says adversaries may schedule exfiltration only at certain times or intervals, to blend with normal traffic or with availability. Scheduled exfiltration is usually paired with other exfiltration techniques that actually move the data, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.

So the schedule is a wrapper around the transfer. What gives it away is regularity: the same job, the same destination, the same time.

How to detect it

MITRE's strategy (DET0399) has three analytics:

• General. Recurring outbound transfers started by scheduled or script based processes, with time based regularity and consistent external destinations.
• Linux and similar. Cron based or script based recurring transfers where the same script, user or destination returns at predictable intervals.
• macOS. LaunchAgent or launchd recurring jobs that start data transfers to consistent external IPs or domains with repeating timing.

Ways to apply that:

1. Beacon style analysis on flow or proxy logs: group outbound connections by source and destination and look for evenly spaced timing.
2. Compare scheduler contents against change records. A new cron entry, scheduled task or LaunchAgent that talks to the internet deserves a question.
3. Track volume by destination over time. Repeated small or medium uploads to the same unfamiliar host stand out against a baseline.
4. Join network events to the process and user that started them.

Backups, update checks and monitoring agents are regular too, so keep a short list of known recurring transfers and alert on everything else.

How to reduce the risk

MITRE lists one mitigation: network intrusion prevention. Systems that use network signatures to identify traffic for specific command and control infrastructure and malware can help at the network level. MITRE cautions that signatures are tied to specific tools and protocols, and adversaries change them over time, so this is one layer and not the whole answer.

Add egress control and scheduler review to it. Allow outbound traffic only to destinations that servers need, and review what is scheduled to run.

Check your own environment

# Linux: list the current user's cron jobs and system cron locations
crontab -l
ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly 2>/dev/null

# macOS: list loaded launchd jobs
launchctl list

# Windows: list enabled scheduled tasks and what they run
Get-ScheduledTask | Where-Object State -ne 'Disabled' |
    Select-Object TaskName, TaskPath, State

Then ask:

• Does every recurring job that sends data out have an owner and a reason?
• Can you query flow or proxy logs for regular timing to one destination?
• Do servers have a default deny outbound policy, or can any of them reach anywhere?

Quick check

Sources

• MITRE ATT&CK, Scheduled Transfer (T1029)