Scheduled Transfer T1029
Tactic: Exfiltration
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.
Events covered
3 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4698 | A scheduled task was created. |
| Security-Auditing | Event ID 4700 | A scheduled task was enabled. |
| Security-Auditing | Event ID 4702 | A scheduled task was updated. |
Authoring guide
These 3 rules share fields, values, and exclusions.
Fields filtered most (12 distinct)
These fields appear most often in rule filters.
Top indicator values (11 distinct)
These values appear most often in rule predicates.
Exclusions (5 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.