Which SIEM platforms have a T1020 detection rule?

df00tech provides T1020 (Automated Exfiltration) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Automated Exfiltration (T1020)?

Detecting Automated Exfiltration requires the following data sources: Process: Process Creation, Command: Command Execution, Network Traffic: Network Connection Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1020 detection?

The T1020 detection is rated high severity with medium confidence.

What are common false positives for T1020?

Common false positives for T1020 include: Backup software agents (Veeam, Acronis, Windows Server Backup) running scheduled backup jobs that compress and transfer files to remote storage; Cloud sync clients (OneDrive sync engine, Dropbox, Google Drive File Stream) automatically uploading files in monitored user directories; Log and telemetry collection agents (Splunk Universal Forwarder, Filebeat, NXLog) that regularly collect and ship log files to SIEM infrastructure.

T1020 IBM QRadar · QRadar

Detect Automated Exfiltration in IBM QRadar

Adversaries may exfiltrate data through the use of automated processing after being gathered during collection. Automated exfiltration commonly involves scripted or programmatic transfer of collected files to attacker-controlled infrastructure on a schedule or triggered basis. This technique is frequently combined with T1041 (Exfiltration Over C2 Channel) or T1048 (Exfiltration Over Alternative Protocol) to move data out of the network. Real-world examples include StrongPity automatically uploading collected documents, Rover scanning local drives on a 60-minute cycle, Raccoon Stealer acting on received configuration files, and Ke3chang performing frequent scheduled exfiltration from compromised networks.

MITRE ATT&CK

Tactic: Exfiltration
Technique: T1020 Automated Exfiltration
Canonical reference: https://attack.mitre.org/techniques/T1020/

QRadar Detection Query

IBM QRadar (QRadar)

sql

/* Branch 1: Scripting engines with exfil-relevant command patterns */
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "Parent Process Name" AS parent_process,
  CASE
    WHEN LOWER("Command") ILIKE '%uploadfile%' OR LOWER("Command") ILIKE '%uploaddata%' OR LOWER("Command") ILIKE '%start-bitstransfer%' THEN 1
    ELSE 0
  END AS has_upload,
  CASE
    WHEN LOWER("Command") ILIKE '%get-childitem%' OR LOWER("Command") ILIKE '%compress-archive%' OR LOWER("Command") ILIKE '%dir /s%' THEN 1
    ELSE 0
  END AS has_collection,
  CASE
    WHEN LOWER("Command") ILIKE '%curl %' OR LOWER("Command") ILIKE '%wget %' OR LOWER("Command") ILIKE '%ftp -%' THEN 1
    ELSE 0
  END AS has_transfer_tool
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 260, 352)
  AND (QIDNAME(qid) = 'Process Launch' OR "EventID" IN ('1', '4688'))
  AND (
    LOWER("Process Name") ILIKE '%powershell.exe%'
    OR LOWER("Process Name") ILIKE '%pwsh.exe%'
    OR LOWER("Process Name") ILIKE '%python.exe%'
    OR LOWER("Process Name") ILIKE '%wscript.exe%'
    OR LOWER("Process Name") ILIKE '%cscript.exe%'
    OR LOWER("Process Name") ILIKE '%cmd.exe%'
  )
  AND (
    (
      LOWER("Command") ILIKE '%uploadfile%'
      OR LOWER("Command") ILIKE '%uploaddata%'
      OR LOWER("Command") ILIKE '%start-bitstransfer%'
      OR LOWER("Command") ILIKE '%net.ftpwebrequest%'
    )
    OR (
      (
        LOWER("Command") ILIKE '%get-childitem%'
        OR LOWER("Command") ILIKE '%compress-archive%'
        OR LOWER("Command") ILIKE '%dir /s%'
      )
      AND (
        LOWER("Command") ILIKE '%curl %'
        OR LOWER("Command") ILIKE '%wget %'
        OR LOWER("Command") ILIKE '%ftp -%'
      )
    )
  )
  AND STARTTIME > NOW() - 86400000

UNION ALL

/* Branch 2: Transfer tools uploading to external destinations */
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "Parent Process Name" AS parent_process,
  0 AS has_upload,
  0 AS has_collection,
  1 AS has_transfer_tool
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 260, 352)
  AND (QIDNAME(qid) = 'Process Launch' OR "EventID" IN ('1', '4688'))
  AND (
    LOWER("Process Name") ILIKE '%curl.exe%'
    OR LOWER("Process Name") ILIKE '%wget.exe%'
    OR LOWER("Process Name") ILIKE '%certutil.exe%'
    OR LOWER("Process Name") ILIKE '%bitsadmin.exe%'
    OR LOWER("Process Name") ILIKE '%ftp.exe%'
    OR LOWER("Process Name") ILIKE '%scp.exe%'
    OR LOWER("Process Name") ILIKE '%sftp.exe%'
  )
  AND (
    LOWER("Command") ILIKE '%-t %'
    OR LOWER("Command") ILIKE '%--upload-file%'
    OR LOWER("Command") ILIKE '%-d @%'
    OR LOWER("Command") ILIKE '%/upload%'
    OR LOWER("Command") ILIKE '%ftp://%'
    OR LOWER("Command") ILIKE '%sftp://%'
  )
  AND STARTTIME > NOW() - 86400000
ORDER BY event_time DESC

high severity medium confidence

AQL detection across two branches: scripting engines invoking file upload or recursive collection combined with transfer tools, and known transfer binaries executing upload-style commands to external destinations. Sources Windows Security Event 4688 and Sysmon Event 1 via QRadar Windows log sources.

Data Sources

QRadar Windows Security Event log sourceQRadar Sysmon log source (Microsoft Windows Sysmon)Microsoft Windows log source type

Required Tables

events

False Positives & Tuning

Automated patch management systems (WSUS, SCCM) that use BitsAdmin to download and upload update packages
Security tools like Carbon Black or CrowdStrike that use PowerShell cmdlets internally for telemetry uploads
Legitimate DevOps workflows where Jenkins or TeamCity pipelines invoke curl or scp to deploy artifacts to remote servers

Download portable Sigma rule (.yml)

Other platforms for T1020

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1PowerShell Automated File Upload via Net.WebClient
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', 'Net.WebClient', 'UploadFile'. Sysmon Event ID 3: Network Connection attempts to 127.0.0.1:8443. PowerShell ScriptBlock Log Event ID 4104 with full script including file collection loop.
Test 2Scheduled Automated Exfiltration via BitsAdmin Upload
Expected signal: Windows Security Event ID 4698 (A scheduled task was created) with task name 'WindowsTelemetryCollect' and action 'bitsadmin /transfer exfil /upload'. Sysmon Event ID 1 for schtasks.exe process creation. Microsoft-Windows-TaskScheduler/Operational Event ID 106 (task registered). When task fires: Sysmon Event ID 1 for bitsadmin.exe with /upload flag in CommandLine.
Test 3Python Script Recursive Collection and Staged Archive Upload
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'zipfile', 'os.walk', 'Documents', 'urllib.request', 'POST'. Sysmon Event ID 11: File Create for collect_df00tech.zip in %TEMP% directory. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080. DeviceFileEvents (MDE) will show the archive creation.
Test 4Curl-Based Automated File Exfiltration Loop (Linux/macOS)
Expected signal: Linux auditd: execve syscall events for bash and curl with full argument arrays. Syslog: process execution records. If Sysmon for Linux deployed: Event ID 1 (Process Create) with CommandLine containing 'find', '-name', 'curl', '-X POST', '-F file=@'. Network: connection attempts from curl to 127.0.0.1:9090. File access events for each file POSTed.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1020 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Automated Exfiltration in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1020

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (1)

Related Techniques

Same Tactic: Exfiltration

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1020

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (1)

Related Techniques

Same Tactic: Exfiltration

Popular Detections

Get new detections in your inbox