Scheduled Transfer

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.

When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.

ID: T1029
Sub-techniques:  No sub-techniques
Tactic: Exfiltration
Platforms: Linux, Windows, macOS
Data Sources: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow
Requires Network:  Yes
Version: 1.1
Created: 31 May 2017
Last Modified: 28 March 2020

Procedure Examples

ID Name Description
S0045 ADVSTORESHELL

ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.[1]

S0154 Cobalt Strike

Cobalt Strike can set its "beacon" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration.[2]

S0126 ComRAT

ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).[3]

S0200 Dipsind

Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.[4]

G0126 Higaisa

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.[5]

S0283 jRAT

jRAT can be configured to reconnect at certain intervals.[6]

S0265 Kazuar

Kazuar can sleep for a specific time and be set to communicate at specific intervals.[7]

S0395 LightNeuron

LightNeuron can be configured to exfiltrate data during nighttime or working hours.[8]

S0211 Linfo

Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.[9]

S0409 Machete

Machete sends stolen data to the C2 server every 10 minutes.[10]

S0223 POWERSTATS

POWERSTATS can sleep for a given number of seconds.[11]

S0596 ShadowPad

ShadowPad has sent data back to C2 every 8 hours.[12]

S0444 ShimRat

ShimRat can sleep when instructed to do so by the C2.[13]

Mitigations

ID Mitigation Description
M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. [14]

Detection

Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious. Network connections to the same destination that occur at the same time of day for multiple days are suspicious.

References