Automated Exfiltration
Where this stands
A Sigma rule exists for this technique in the corpus.
A detection for this technique exists in the corpus. Log in to read it.
When a detection for this fires
Collection and exfiltrationData being gathered or moved. This is where a security incident becomes a disclosure obligation.What the technique is
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1113
Detection of automated tools or scripts periodically transmitting data to external destinations using scheduled tasks or background processes.
- AN1114
Background scripts (e.g., via cron) or daemons transmitting data repeatedly to remote IPs or URLs.
- AN1115
Observation of LaunchAgents or LaunchDaemons establishing periodic external connections indicative of automated data transfer.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.