Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudCLI-ScheduledExfil.
Upgrade to ProDetect Scheduled Transfer via Cloud Sync/Backup CLI Tools in Elastic Security
Adversaries increasingly implement Scheduled Transfer (T1029) not with custom malware beacon loops but by abusing legitimate, already-installed cloud sync and backup command-line tools — rclone, restic, aws-cli (s3 sync/cp), azcopy, and gsutil — invoked on a fixed interval via cron, systemd timers, or Windows Task Scheduler. This approach blends with routine backup/sync traffic, uses signed and expected binaries, and often targets attacker-controlled cloud storage (a non-corporate S3 bucket, a personal rclone remote, a throwaway Backblaze/Azure account) rather than a custom C2 server, evading network-signature and IP-reputation detections. This pattern has been widely observed in ransomware pre-encryption exfiltration (rclone is the single most frequently recovered exfiltration tool across ransomware IR engagements) and in insider-driven bulk data theft where a scheduled job is created to stage and ship data outside normal working hours. This detection complements the existing T1029 coverage (which focuses on raw network beaconing and generic scheduled-task-spawns-transfer-tool patterns) by specifically fingerprinting cloud-storage CLI syntax, non-corporate destination indicators, and the scheduler-persistence mechanism used to make the transfer recurring.
MITRE ATT&CK
- Tactic
- Exfiltration
Elastic Detection Query
// Alert 1: Cloud CLI tool spawned by a scheduler parent process
process where event.type == "start" and
process.name in~ ("rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe", "mc.exe") and
process.parent.name in~ ("taskeng.exe", "taskhostw.exe", "svchost.exe", "schtasks.exe") and
process.args : ("*sync*", "*copy*", "*cp*", "*put*", "*push*", "*backup*")
/* Alert 2: run as a separate EQL query — 3+ upload-verb invocations of the same binary within a 7-day window (sequence with runs) */
sequence by host.name, process.name, user.name with maxspan=7d
[process where event.type == "start" and
process.name in~ ("rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe") and
process.args : ("*sync*", "*copy*", "*cp*", "*put*", "*push*")
] with runs=3Two EQL queries for T1029 via cloud CLI tooling. The first detects rclone/restic/aws-cli/azcopy/gsutil/mc spawned directly by a Task Scheduler or service-host parent process with an upload-style verb in the arguments. The second uses the EQL 'with runs=3' sequence syntax to identify the same binary, host, and user invoking an upload verb three or more times within a rolling 7-day window — the recurring-schedule behavioural signature. Run each independently in Kibana or Elastic Security.
Data Sources
Required Tables
False Positives & Tuning
- Approved backup automation using rclone/restic scheduled via Task Scheduler or cron to an approved corporate storage destination
- CI/CD pipelines invoking aws s3 sync or azcopy on a recurring build schedule to push artifacts to an approved bucket
- MSP-managed backup tooling built on rclone performing scheduled multi-tenant backup rotation
Other platforms for THREAT-CloudCLI-ScheduledExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows — Scheduled Task Running rclone Sync to External Remote
Expected signal: Windows Security Event ID 4698 (scheduled task created) for task name 'CloudBackupSync'. Sysmon Event ID 1 for schtasks.exe process creation with '/create /sc MINUTE /mo 30' in the command line. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning cmd.exe spawning rclone.exe with 'sync' in the command line.
- Test 2Windows — Recurring aws s3 sync Invocations Simulating a Scheduled Exfiltration Job
Expected signal: Sysmon Event ID 1: three Process Create events for aws.exe with 's3', 'sync', and '--endpoint-url' in the command line, spaced a few seconds apart (compressed for testing; production pattern spans days). Sysmon Event ID 3: connection attempts to 127.0.0.1:9999.
- Test 3Linux — Systemd Timer Triggering Scheduled restic Backup to External Repository
Expected signal: Auditd or Sysmon-for-Linux: file write events for /etc/systemd/system/restic-sync-test.service and .timer. Process execution events for systemctl with 'daemon-reload' and 'enable --now'. When the timer fires: execve event for restic with 'backup' argument, PPID belonging to systemd.
References (7)
- https://attack.mitre.org/techniques/T1029/
- https://rclone.org/docs/
- https://redcanary.com/blog/threat-intelligence/rclone-mass-file-transfer/
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1029/T1029.md
- https://www.freedesktop.org/software/systemd/man/systemd.timer.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudCLI-ScheduledExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-ArchiveStaging-ScheduledExfilScheduled Batch Exfiltration of Compressed Archive StagingUse for archive staging — rar/7z multi-volume splitting ahead of a timed transfer, typical of ransomware double-extortion.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.