// MITRE ATT&CK
T1029 · Scheduled Transfer
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the...
How to detect & mitigate it
Detecting Scheduled Transfer starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1567
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1011
Exfiltration Over Other Network Medium T1011.001
Exfiltration Over Bluetooth T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.