Detect Automated Exfiltration in Sumo Logic CSE
Adversaries may exfiltrate data through the use of automated processing after being gathered during collection. Automated exfiltration commonly involves scripted or programmatic transfer of collected files to attacker-controlled infrastructure on a schedule or triggered basis. This technique is frequently combined with T1041 (Exfiltration Over C2 Channel) or T1048 (Exfiltration Over Alternative Protocol) to move data out of the network. Real-world examples include StrongPity automatically uploading collected documents, Rover scanning local drives on a 60-minute cycle, Raccoon Stealer acting on received configuration files, and Ke3chang performing frequent scheduled exfiltration from compromised networks.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1020 Automated Exfiltration
- Canonical reference
- https://attack.mitre.org/techniques/T1020/
Sumo Detection Query
// Branch 1: Scripting engines with upload or collection+transfer patterns
_sourceCategory=*windows*sysmon* OR _sourceCategory=*wineventlog*
| where EventCode = 1 OR EventID = 1
| parse field=Image "*\\*" as image_dir, image_name
| where image_name in ("powershell.exe", "pwsh.exe", "python.exe", "python3.exe", "wscript.exe", "cscript.exe", "cmd.exe")
| eval cmdl = toLowerCase(CommandLine)
| eval HasUpload = if(matches(cmdl, "(uploadfile|uploaddata|uploadstring|start-bitstransfer|net\.ftpwebrequest|invoke-webrequest)"), 1, 0)
| eval HasCollection = if(matches(cmdl, "(get-childitem|\bgci\b|dir\s/s|compress-archive|\[io\.file\]::|\-recurse)"), 1, 0)
| eval HasTransferTool = if(matches(cmdl, "(curl\s|wget\s|ftp\s-|\bsftp\s)"), 1, 0)
| eval SensitivePath = if(matches(cmdl, "(\\\\documents\\\\|\\\\desktop\\\\|\\\\appdata\\\\|\\\\programdata\\\\|\\\\temp\\\\)"), 1, 0)
| eval ExfilScore = HasUpload + HasCollection + HasTransferTool + SensitivePath
| where ExfilScore >= 2
| fields _messageTime, Computer, User, image_name, CommandLine, ParentImage, ParentCommandLine, HasUpload, HasCollection, HasTransferTool, SensitivePath, ExfilScore
| concat("scripting_engine") as Branch
// Branch 2: Transfer tools with upload-type arguments
| union [
_sourceCategory=*windows*sysmon*
| where EventCode = 1
| parse field=Image "*\\*" as img_dir, img_name
| where img_name in ("curl.exe", "wget.exe", "certutil.exe", "bitsadmin.exe", "ftp.exe", "sftp.exe", "scp.exe")
| eval cmdl = toLowerCase(CommandLine)
| eval IsUpload = if(matches(cmdl, "(-t\s|--upload-file|-d\s@|--data-binary\s@|/upload|/transfer|ftp://|sftp://|ftps://)"), 1, 0)
| eval IsExternal = if(matches(CommandLine, "(ftp|sftp|http|https)://") and !matches(CommandLine, "(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)"), 1, 0)
| where IsUpload = 1
| fields _messageTime, Computer, User, img_name, CommandLine, ParentImage, IsUpload, IsExternal
| concat("transfer_tool") as Branch
]
// Branch 3: Archive + network correlation
| union [
_sourceCategory=*windows*sysmon*
| where EventCode = 1
| parse field=Image "*\\*" as arch_dir, arch_name
| where arch_name in ("7z.exe", "7za.exe", "rar.exe", "winrar.exe", "tar.exe", "zip.exe")
| eval cmdl = toLowerCase(CommandLine)
| eval HasSensitiveSrc = if(matches(cmdl, "(\\\\documents|\\\\desktop|\\\\users|\\\\appdata|\\\\programdata)"), 1, 0)
| where HasSensitiveSrc = 1
| eval ArchiveTime = _messageTime
| timeslice 5m
| fields Computer, User, arch_name, CommandLine, ArchiveTime, _timeslice
| join Computer [
_sourceCategory=*windows*sysmon*
| where EventCode = 3
| where !matches(DestinationIp, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)")
| fields Computer, DestinationIp, DestinationPort, _messageTime
]
| where abs(_messageTime - ArchiveTime) <= 300
| fields ArchiveTime, Computer, User, arch_name, CommandLine, DestinationIp, DestinationPort
| concat("archive_then_network") as Branch
]
| sort by _messageTime descThree-branch detection for automated exfiltration: scripting engines with upload or collection patterns scored by signal strength, transfer binaries executing upload-style commands to external hosts, and archive tools operating on sensitive paths correlated with outbound network connections within a 5-minute window.
Data Sources
Required Tables
False Positives & Tuning
- Automated cloud sync clients (OneDrive, Dropbox) that use PowerShell SDK calls to upload files from Documents or AppData directories
- Security operations tooling (Tanium, BigFix) running scripted collections that zip diagnostic data and transmit to management infrastructure
- Database backup jobs using Python scripts to archive and FTP database dumps to off-site storage per retention policy
Other platforms for T1020
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Automated File Upload via Net.WebClient
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', 'Net.WebClient', 'UploadFile'. Sysmon Event ID 3: Network Connection attempts to 127.0.0.1:8443. PowerShell ScriptBlock Log Event ID 4104 with full script including file collection loop.
- Test 2Scheduled Automated Exfiltration via BitsAdmin Upload
Expected signal: Windows Security Event ID 4698 (A scheduled task was created) with task name 'WindowsTelemetryCollect' and action 'bitsadmin /transfer exfil /upload'. Sysmon Event ID 1 for schtasks.exe process creation. Microsoft-Windows-TaskScheduler/Operational Event ID 106 (task registered). When task fires: Sysmon Event ID 1 for bitsadmin.exe with /upload flag in CommandLine.
- Test 3Python Script Recursive Collection and Staged Archive Upload
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'zipfile', 'os.walk', 'Documents', 'urllib.request', 'POST'. Sysmon Event ID 11: File Create for collect_df00tech.zip in %TEMP% directory. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080. DeviceFileEvents (MDE) will show the archive creation.
- Test 4Curl-Based Automated File Exfiltration Loop (Linux/macOS)
Expected signal: Linux auditd: execve syscall events for bash and curl with full argument arrays. Syslog: process execution records. If Sysmon for Linux deployed: Event ID 1 (Process Create) with CommandLine containing 'find', '-name', 'curl', '-X POST', '-F file=@'. Network: connection attempts from curl to 127.0.0.1:9090. File access events for each file POSTed.
References (10)
- https://attack.mitre.org/techniques/T1020/
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
- https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
- https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf
- https://www.welivesecurity.com/2019/05/07/turla-lightneuron-email-too-far/
- https://attack.mitre.org/software/S0409/
- https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1020/T1020.md
Unlock Pro Content
Get the full detection package for T1020 including response playbook, investigation guide, and atomic red team tests.