Detect Automated Exfiltration in Elastic Security
Adversaries may exfiltrate data through the use of automated processing after being gathered during collection. Automated exfiltration commonly involves scripted or programmatic transfer of collected files to attacker-controlled infrastructure on a schedule or triggered basis. This technique is frequently combined with T1041 (Exfiltration Over C2 Channel) or T1048 (Exfiltration Over Alternative Protocol) to move data out of the network. Real-world examples include StrongPity automatically uploading collected documents, Rover scanning local drives on a 60-minute cycle, Raccoon Stealer acting on received configuration files, and Ke3chang performing frequent scheduled exfiltration from compromised networks.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1020 Automated Exfiltration
- Canonical reference
- https://attack.mitre.org/techniques/T1020/
Elastic Detection Query
sequence by host.name with maxspan=5m
[process where event.type == "start" and
process.name in~ ("7z.exe", "7za.exe", "winrar.exe", "rar.exe", "tar.exe", "zip.exe") and
(
process.args like~ "*\\Documents\\*" or
process.args like~ "*\\Desktop\\*" or
process.args like~ "*\\Users\\*" or
process.args like~ "*\\AppData\\*" or
process.args like~ "*\\ProgramData\\*"
)
]
[network where event.type == "connection" and
not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8") and
network.direction == "egress"
]
/* Branch 2: Scripting engines with upload or recursive collection patterns */
until [process where event.type == "end"]
/* Standalone scripting engine detection */
any where event.category == "process" and event.type == "start" and
process.name in~ ("powershell.exe", "pwsh.exe", "python.exe", "python3.exe", "wscript.exe", "cscript.exe", "cmd.exe") and
(
(
process.args like~ "*UploadFile*" or
process.args like~ "*UploadData*" or
process.args like~ "*Start-BitsTransfer*" or
process.args like~ "*Net.FtpWebRequest*" or
process.args like~ "*Invoke-WebRequest*"
) or
(
(process.args like~ "*Get-ChildItem*" or process.args like~ "*dir /s*" or process.args like~ "*Compress-Archive*") and
(process.args like~ "*curl *" or process.args like~ "*wget *" or process.args like~ "*ftp -*")
)
)Detects automated exfiltration behaviors via three branches: (1) archive tool creating archives from sensitive paths followed within 5 minutes by external network connection; (2) scripting engines invoking upload APIs or combining recursive file collection with transfer tools. Covers StrongPity, Rover, Raccoon Stealer, and Ke3chang-style exfil patterns.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate backup software (Veeam, Acronis) that archives directories and uploads to cloud storage on a schedule
- Developer tooling such as CI/CD pipelines that zip build artifacts and upload them to S3 or Azure Blob via curl/sftp
- IT administrators using BITS transfers or robocopy with FTP for routine file distribution to external partners
Other platforms for T1020
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Automated File Upload via Net.WebClient
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', 'Net.WebClient', 'UploadFile'. Sysmon Event ID 3: Network Connection attempts to 127.0.0.1:8443. PowerShell ScriptBlock Log Event ID 4104 with full script including file collection loop.
- Test 2Scheduled Automated Exfiltration via BitsAdmin Upload
Expected signal: Windows Security Event ID 4698 (A scheduled task was created) with task name 'WindowsTelemetryCollect' and action 'bitsadmin /transfer exfil /upload'. Sysmon Event ID 1 for schtasks.exe process creation. Microsoft-Windows-TaskScheduler/Operational Event ID 106 (task registered). When task fires: Sysmon Event ID 1 for bitsadmin.exe with /upload flag in CommandLine.
- Test 3Python Script Recursive Collection and Staged Archive Upload
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'zipfile', 'os.walk', 'Documents', 'urllib.request', 'POST'. Sysmon Event ID 11: File Create for collect_df00tech.zip in %TEMP% directory. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080. DeviceFileEvents (MDE) will show the archive creation.
- Test 4Curl-Based Automated File Exfiltration Loop (Linux/macOS)
Expected signal: Linux auditd: execve syscall events for bash and curl with full argument arrays. Syslog: process execution records. If Sysmon for Linux deployed: Event ID 1 (Process Create) with CommandLine containing 'find', '-name', 'curl', '-X POST', '-F file=@'. Network: connection attempts from curl to 127.0.0.1:9090. File access events for each file POSTed.
References (10)
- https://attack.mitre.org/techniques/T1020/
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
- https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
- https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf
- https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-far/
- https://attack.mitre.org/software/S0409/
- https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1020/T1020.md
Unlock Pro Content
Get the full detection package for T1020 including response playbook, investigation guide, and atomic red team tests.