{"id":"T1029","name":"Scheduled Transfer","url":"https://attack.mitre.org/techniques/T1029","tactics":["exfiltration"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0399","stix_id":"x-mitre-detection-strategy--3ec6ad13-f3d6-4eb2-91fe-6ee5266d1447","name":"Detection Strategy for Scheduled Transfer and Recurrent Exfiltration Patterns","url":"https://attack.mitre.org/detectionstrategies/DET0399","analytics":[{"id":"AN1118","stix_id":"x-mitre-analytic--79600919-afe8-4ac9-946c-147d85af6cfe","name":"Analytic 1118","description":"Recurring network exfiltration initiated by scheduled or script-based processes exhibiting time-based regularity and consistent external destinations.","url":"https://attack.mitre.org/detectionstrategies/DET0399#AN1118","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:System","channel":"EventCode=106, 200","data_component":"DC0005","data_component_name":"Scheduled Job Metadata","log_source_slug":"wineventlog-system"}],"mutable_elements":[{"field":"TimeWindow","description":"Duration threshold to consider a connection repetitive (e.g., same hour daily)"},{"field":"DestIPAllowlist","description":"Known external destinations to exclude (e.g., approved SFTP/backup servers)"},{"field":"ParentProcessBaseline","description":"Allowlisted job runners or scripts known to schedule legitimate transfers"}],"live":true,"detection_strategies":["DET0399"],"techniques":["T1029"]},{"id":"AN1119","stix_id":"x-mitre-analytic--11ac52fe-f8e0-4748-9fbc-2f85c43ad506","name":"Analytic 1119","description":"Detection of cron-based or script-based recurring transfers where the same script, user, or destination reappears at predictable intervals.","url":"https://attack.mitre.org/detectionstrategies/DET0399#AN1119","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:cron","channel":"cron activity","data_component":"DC0005","data_component_name":"Scheduled Job Metadata","log_source_slug":"linux-cron"},{"name":"NSM:Flow","channel":"Outbound Connections","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ScriptPathRegex","description":"Path patterns for shell scripts responsible for scheduled transfers"},{"field":"CronIntervalThreshold","description":"Minimum repetition frequency (e.g., 24h for daily jobs)"},{"field":"ExfilUserContext","description":"Suspicious or unexpected users launching scheduled transfers"}],"live":true,"detection_strategies":["DET0399"],"techniques":["T1029"]},{"id":"AN1120","stix_id":"x-mitre-analytic--837bd639-c291-4e42-b737-6a21d6bf8fd5","name":"Analytic 1120","description":"LaunchAgent or launchd recurring jobs initiating data transfer to consistent external IPs or domains with repeat timing signatures.","url":"https://attack.mitre.org/detectionstrategies/DET0399#AN1120","platforms":["macOS"],"log_source_references":[{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"macos:launchd","channel":"launchd.plist and logs","data_component":"DC0005","data_component_name":"Scheduled Job Metadata","log_source_slug":"macos-launchd"},{"name":"macos:unifiedlog","channel":"networkd or com.apple.network","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AgentPathPatterns","description":"Regex for job locations like ~/Library/LaunchAgents/"},{"field":"RepeatIntervalDelta","description":"Time-based logic to determine schedule (e.g., ~24h ± 5m)"},{"field":"UserHomeJobs","description":"Transfers originating from non-admin user context"}],"live":true,"detection_strategies":["DET0399"],"techniques":["T1029"]}],"live":true,"version":"1.0","techniques":["T1029"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}