Automated Exfiltration T1020

Tactic: Exfiltration

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 49 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (64 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType10eq 9, contains 1AmsiScriptContent, CreateTrafficMirrorSession, FileDownloaded, git.clone, protected_branch.policy_override
aws::eventSource7eq 7rds.amazonaws.com, SharePoint, SecurityComplianceCenter
data_stream.dataset7eq 7github.audit, aws.cloudtrail, o365.audit
m365::Workload6eq 4, contains 2Exchange, onedrive, sharepoint
Operation5contains 3, in 2New-TransportRule, Set-TransportRule, filedownloaded, filesyncdownloadedfull, filesyncuploadedfull
aws::eventName5eq 5RestoreDBInstanceFromDBSnapshot, DeleteDBCluster, ModifyDBCluster, ModifyDBInstance, Suspicious inbox forwarding
process_name5contains 2, eq 1, ne 1, regex_match 1rclone.exe, sftp, (?i)\w+\.(exe)
CommandLine4regex_match 3, in 1(?i)\w+\.(bat|ps1|sh), *--auto-confirm*, *--config*, *--ignore-existing*
EventID4eq 40, 1, 4688
action4eq 2, starts_with 2hook., migration.create, org.transfer, org.transfer_outgoing, private_repository_forking.clear
github.category4eq 4protected_branch, pull_request, repo
ScriptBlockText3contains 3, match 1-method "post", -method "put", -method 'post', [system.net.dns]::gethostentry, foreach
event.type3eq 3change
m365::Parameters3contains 3forwardingsmtpaddress, forwardto, redirectto, forwardasattachmentto, forwardingaddress
DestinationMailAddress2is_not_null 2

Top indicator values (232 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
data_stream.dataseteq
github.audit
518
aws::eventSourceeq
rds.amazonaws.com
423
aws::eventSourceeq
SharePoint
22
m365::Workloadeq
Exchange
48
CommandLineregex_match
(?i)\w+\.(bat|ps1|sh)
33
event.typeeq
change
377
m365::Parameterscontains
forwardingsmtpaddress
33
m365::Parameterscontains
forwardto
33
m365::Parameterscontains
redirectto
33
DistinctUserCountgt
1
22
EventIDeq
0
22
EventLogeq
Application
23
Operationcontains
filedownloaded
22
Operationcontains
filesyncdownloadedfull
22
Operationcontains
filesyncuploadedfull
22
Operationcontains
fileuploaded
22
Operationin
New-TransportRule
22
Operationin
Set-TransportRule
24
OriginalFileNameeq
rclone.exe
23
RenderedDescriptioncontains
downloaded
22
RenderedDescriptioncontains
uploaded
22
SyslogMessagecontains
bytes read
22
SyslogMessagecontains
close
22
SyslogMessagecontains
session opened for
22
UserOrientedeq
Yes
22
actionstarts_with
hook.
22
aws::eventNameeq
RestoreDBInstanceFromDBSnapshot
22
event.outcomeeq
success
2251
github.categoryeq
protected_branch
24
m365::Workloadcontains
onedrive
22

Exclusions (6 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
AADEmaileq
[]
1
Imagestarts_with
c:\\
1
m365::ApplicationIdin
08e18876-6177-487e-b8b5-cf950c1e598c
1
m365::ApplicationIdin
7ab7862c-4c57-491e-8a45-d52a7e023983
1
m365::ApplicationIdin
d3590ed6-52b3-4102-aeff-aad2292ab01c
1
m365::ApplicationIdin
fb8d773d-7ef8-4ec0-a117-179f88add510
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 10 rules

Elastic 7 rules

Splunk 7 rules

Kusto 19 rules

Panther 6 rules