Scheduled Transfer — Scheduled Off-Hours Bulk Data Transfer

let WorkHoursStart = 7;
let WorkHoursEnd = 19;
// Signal 1: scheduled task or cron-like persistence created shortly before an off-hours transfer
let ScheduledTaskSignal = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("schtasks.exe", "at.exe", "crontab")
| where ProcessCommandLine has_any ("/create", "/sc", "-e")
| project TaskTime=Timestamp, DeviceName, AccountName, TaskCommandLine=ProcessCommandLine;
// Signal 2: large outbound network transfer occurring outside of working hours
let OffHoursTransfer = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where BytesSent > 104857600 // >100MB
| extend HourOfDay = datetime_part("hour", Timestamp)
| where HourOfDay < WorkHoursStart or HourOfDay >= WorkHoursEnd
| extend BytesSentMB = round(toreal(BytesSent) / 1048576, 2)
| project TransferTime=Timestamp, DeviceName, RemoteUrl, RemoteIP, BytesSentMB, InitiatingProcessFileName, InitiatingProcessCommandLine;
OffHoursTransfer
| join kind=leftouter (ScheduledTaskSignal) on DeviceName
| extend HasRecentScheduledTask = isnotempty(TaskCommandLine) and (TransferTime - TaskTime) between (0min .. 6h)
| project TransferTime, DeviceName, RemoteUrl, RemoteIP, BytesSentMB, InitiatingProcessFileName, InitiatingProcessCommandLine, HasRecentScheduledTask, TaskCommandLine
| sort by BytesSentMB desc

index=network sourcetype="netflow" OR sourcetype="pan:traffic"
| eval BytesSentMB=round(bytes_out/1048576, 2)
| where bytes_out > 104857600
| eval hour_of_day=strftime(_time, "%H")
| where hour_of_day < 7 OR hour_of_day >= 19
| eval TransferTime=_time
| join type=left host
  [ search index=wineventlog sourcetype="XmlWinEventLog:Security" EventCode=4698
    | eval TaskTime=_time
    | table host, TaskTime, TaskName ]
| eval HasRecentScheduledTask=if(isnotnull(TaskTime) AND (TransferTime - TaskTime) >= 0 AND (TransferTime - TaskTime) <= 21600, 1, 0)
| table TransferTime, host, dest_ip, BytesSentMB, HasRecentScheduledTask, TaskName
| sort - BytesSentMB

sequence by host.name with maxspan=6h
  [process where event.type == "start" and
   process.name : ("schtasks.exe", "at.exe", "crontab") and
   process.command_line : ("*create*", "*-e*")]
  [network where event.type == "connection" and
   network.direction == "outbound" and
   network.bytes_sent > 104857600]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  "Computer" AS Hostname,
  destinationip AS DestinationIP,
  LONG("BytesSent") AS BytesSent,
  EXTRACT(HOUR FROM starttime) AS HourOfDay
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Netflow', 'Palo Alto Networks Firewall')
  AND starttime > NOW() - 1 DAYS
  AND LONG("BytesSent") > 104857600
  AND (EXTRACT(HOUR FROM starttime) < 7 OR EXTRACT(HOUR FROM starttime) >= 19)
ORDER BY BytesSent DESC

_sourceCategory="network/netflow"
| where bytes_out > 104857600
| eval hour_of_day=hourofday(_messagetime)
| where hour_of_day < 7 or hour_of_day >= 19
| eval BytesSentMB=round(bytes_out/1048576, 2)
| table _messagetime, host, dest_ip, BytesSentMB, hour_of_day
| sort by BytesSentMB desc

rule threat_exfil_scheduled_bulk_transfer {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects a scheduled task or cron job creation followed by a large off-hours outbound transfer, indicating T1029 - Scheduled Transfer"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1029"
    severity = "MEDIUM"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1029/"
    version = "1.0"
    created = "2026-07-15"

  events:
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    AND $e1.target.process.file.full_path = /(?i)(schtasks\.exe|at\.exe|crontab)/
    AND $e1.target.process.command_line = /(?i)(create|-e)/

    $e2.metadata.event_type = "NETWORK_CONNECTION"
    AND $e2.network.direction = "OUTBOUND"
    AND $e2.network.sent_bytes > 104857600

    $e1.principal.hostname = $e2.principal.hostname

  match:
    $e1.principal.hostname over 6h

  condition:
    $e1 and $e2
}

#repo="base_sensor"
#event_simpleName="NetworkConnectIP4"
| BytesSent > 104857600
| eval HourOfDay = formatTime(format="%H", field="@timestamp")
| test(HourOfDay < "07" or HourOfDay >= "19")
| join type=left
  [ #event_simpleName="ProcessRollup2"
    | ImageFileName = /(?i)(schtasks\.exe|at\.exe|crontab)/
    | CommandLine = /(?i)(create|-e)/
  ]
  on ComputerName
| groupBy([ComputerName, RemoteAddressIP4], function=[sum(BytesSent, as=TotalBytes), count(as=TransferCount)])
| where TotalBytes > 104857600
| sort(TotalBytes, order=desc, limit=1000)