Detect Scheduled Transfer in CrowdStrike LogScale
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This is commonly observed in malware configured to beacon or exfiltrate at fixed intervals (e.g., every 10 minutes, every 8 hours) or only during business hours to blend with normal traffic. Scheduled transfer almost always combines with another exfiltration technique such as Exfiltration Over C2 Channel (T1041) or Exfiltration Over Alternative Protocol (T1048). Real-world examples include ComRAT sleeping outside 9-to-5 Monday–Friday, LightNeuron configuring nighttime-only exfiltration windows, ADVSTORESHELL compressing and exfiltrating every 10 minutes, and Cobalt Strike Beacon using randomized sleep intervals to resist frequency-based detection.
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1029 Scheduled Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1029/
LogScale Detection Query
// Part 1: Beaconing — NetworkConnectIP4 events grouped by process/destination to find regular-interval outbound connections
#event_simpleName=NetworkConnectIP4
| not cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| not cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| not cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| not cidr(RemoteAddressIP4, subnet="127.0.0.0/8")
| not cidr(RemoteAddressIP4, subnet="169.254.0.0/16")
| ImageFileName != /(?i)(chrome|firefox|msedge|MicrosoftEdge|iexplore|teams|outlook|slack|zoom|OneDrive|svchost|MsMpEng|SecurityHealthService|SearchIndexer|WerFault|spoolsv|lsass|services|smss)\.exe$/
| groupBy(
[ComputerName, ImageFileName, CommandLine, UserName, RemoteAddressIP4],
function=[
count(as=ConnectionCount),
min(@timestamp, as=EarliestConnMs),
max(@timestamp, as=LatestConnMs),
values(RemotePort, as=RemotePorts)
]
)
| ConnectionCount >= 5
| TimeSpanMinutes := (LatestConnMs - EarliestConnMs) / 60000
| TimeSpanMinutes >= 20
| AvgIntervalMinutes := TimeSpanMinutes / (ConnectionCount - 1)
| AvgIntervalMinutes >= 1
| AvgIntervalMinutes <= 120
| IsHighConfidenceBeacon := if(ConnectionCount >= 8 AND AvgIntervalMinutes >= 5 AND AvgIntervalMinutes <= 30, "true", "false")
| "Beaconing" as DetectionType
| sort(ConnectionCount, order=desc)
// Part 2: Scheduled task process spawning exfiltration tools — run as separate LogScale query
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)(taskeng|taskhostw|schtasks)\.exe$/
OR (ParentBaseFileName = /(?i)svchost\.exe$/ AND ParentCommandLine = /(?i)Schedule/)
| FileName = /(?i)(curl|certutil|bitsadmin|ftp|tftp|rclone|nc|ncat|robocopy)\.exe$/
OR (
FileName = /(?i)(powershell|pwsh)\.exe$/
AND CommandLine = /(?i)(Invoke-WebRequest|New-Object.*WebClient|UploadFile|UploadData|FtpWebRequest|HttpClient|SendAsync)/
)
OR (
FileName = /(?i)cmd\.exe$/
AND CommandLine = /(?i)(curl[\s]|certutil[\s]|bitsadmin[\s])/
)
| "ScheduledTaskExfil" as DetectionType
| table(
[ComputerName, UserName, FileName, CommandLine,
ParentBaseFileName, ParentCommandLine, DetectionType]
)Two CrowdStrike LogScale queries for T1029 Scheduled Transfer. Part 1 aggregates NetworkConnectIP4 Falcon events by host/process/destination IP to detect beaconing: 5+ outbound connections with TimeSpanMinutes >= 20 and AvgIntervalMinutes between 1 and 120, excluding browser and OS processes and private IP ranges. IsHighConfidenceBeacon is set when ConnectionCount >= 8 with 5–30 minute average intervals. Part 2 matches ProcessRollup2 events where task scheduler parent processes (taskeng.exe, taskhostw.exe, schtasks.exe) directly spawn known data exfiltration tools or PowerShell/cmd with transfer commands. Run each query independently; correlate on ComputerName + UserName for enriched context.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor or other EDR agents (SentinelOne, Defender ATP) performing regular telemetry uploads — their process names may not match common browser/OS exclusions and will appear as beaconing; add sensor binaries to the exclusion regex
- IT automation tools executed via Task Scheduler (Ansible WinRM runner, SCCM Software Center launcher) that use PowerShell with WebClient or curl to communicate with automation controllers on regular check-in intervals
- PowerShell DSC (Desired State Configuration) Local Configuration Manager running in pull mode, invoking WebClient to retrieve MOF files from a pull server at the configured RefreshFrequencyMins interval (default 30 minutes)
Other platforms for T1029
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows — Scheduled Task Periodic HTTP Transfer (PowerShell)
Expected signal: Sysmon Event ID 1: Process Create for schtasks.exe with CommandLine containing '/create /sc MINUTE /mo 5'. Windows Security Event ID 4698 (A scheduled task was created) in the Security event log. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning powershell.exe with '-WindowStyle Hidden'. Sysmon Event ID 3 for the network connection attempt to 127.0.0.1:8080.
- Test 2Windows — Simulated Beacon Loop with Fixed Sleep Interval
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the loop command. Sysmon Event ID 3: Three network connection events to 127.0.0.1:9999 spaced approximately 120 seconds apart, all with the same InitiatingProcessId. The beaconing detection aggregates these into ConnectionCount=3 with AvgIntervalMinutes ≈ 2.0.
- Test 3Linux — Cron-Based Periodic Exfiltration Simulation
Expected signal: Auditd event (if configured with -w /var/spool/cron/crontabs -p wa): SYSCALL write to the crontab file. Cron daemon syslog entry (/var/log/syslog or /var/log/cron): 'CRON[<pid>]: (<user>) CMD (curl -s -X POST...)' every 5 minutes. Syslog or auditd execve events for curl spawned by cron daemon (PPID = crond). Network connection from curl to 127.0.0.1:8080.
- Test 4Windows — BITS Job Scheduled Data Exfiltration Simulation
Expected signal: Sysmon Event ID 1: Process Create for bitsadmin.exe with /create, /addfile, /resume subcommands. Sysmon Event ID 3: Network connection from svchost.exe (BITS service) to 127.0.0.1:8080 when the job attempts execution. Windows Application Event Log: Microsoft-Windows-Bits-Client/Operational — Event ID 3 (job created), 59 (job started), 61 (job error on failed connection). Security Event ID 4688 for bitsadmin.exe if command line auditing is enabled.
References (10)
- https://attack.mitre.org/techniques/T1029/
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
- https://www.welivesecurity.com/2020/05/26/operation-lagtime-it-backdoors-government-networks-eastern-asia/
- https://securelist.com/shadowpad-in-corporate-networks/81432/
- https://cobaltstrike.com/help-beacon
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1029/T1029.md
- https://www.mandiant.com/resources/blog/identifying-cobalt-strike-team-servers-in-the-wild
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Unlock Pro Content
Get the full detection package for T1029 including response playbook, investigation guide, and atomic red team tests.