Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ScheduledBulkTransfer.
Upgrade to ProDetect Scheduled Off-Hours Bulk Data Transfer in Microsoft Sentinel
Adversaries may schedule data exfiltration to occur only at specific times of day — typically off-hours, overnight, or during weekends — to blend the transfer with lower baseline traffic and reduce the likelihood of live monitoring or analyst review. This is frequently implemented via a scheduled task, cron job, or malware-internal timer that triggers a bulk upload once collected data has been staged. Detection focuses on identifying large outbound data transfers that occur outside of a host or user's established working-hours baseline, especially when correlated with a scheduled task or cron job creation shortly beforehand.
MITRE ATT&CK
- Tactic
- Exfiltration
KQL Detection Query
let WorkHoursStart = 7;
let WorkHoursEnd = 19;
// Signal 1: scheduled task or cron-like persistence created shortly before an off-hours transfer
let ScheduledTaskSignal = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("schtasks.exe", "at.exe", "crontab")
| where ProcessCommandLine has_any ("/create", "/sc", "-e")
| project TaskTime=Timestamp, DeviceName, AccountName, TaskCommandLine=ProcessCommandLine;
// Signal 2: large outbound network transfer occurring outside of working hours
let OffHoursTransfer = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where BytesSent > 104857600 // >100MB
| extend HourOfDay = datetime_part("hour", Timestamp)
| where HourOfDay < WorkHoursStart or HourOfDay >= WorkHoursEnd
| extend BytesSentMB = round(toreal(BytesSent) / 1048576, 2)
| project TransferTime=Timestamp, DeviceName, RemoteUrl, RemoteIP, BytesSentMB, InitiatingProcessFileName, InitiatingProcessCommandLine;
OffHoursTransfer
| join kind=leftouter (ScheduledTaskSignal) on DeviceName
| extend HasRecentScheduledTask = isnotempty(TaskCommandLine) and (TransferTime - TaskTime) between (0min .. 6h)
| project TransferTime, DeviceName, RemoteUrl, RemoteIP, BytesSentMB, InitiatingProcessFileName, InitiatingProcessCommandLine, HasRecentScheduledTask, TaskCommandLine
| sort by BytesSentMB descDetects large outbound data transfers (>100MB) occurring outside of standard working hours (before 07:00 or after 19:00 local time), then enriches each transfer with whether a scheduled task or at-job was created on the same host within the preceding 6 hours — a strong indicator that the transfer was triggered by a deliberately scheduled exfiltration mechanism rather than incidental off-hours activity (e.g., a batch job or backup).
Data Sources
Required Tables
False Positives & Tuning
- Legitimate overnight backup jobs (database backups, file server replication, disaster-recovery sync) that are scheduled via Task Scheduler or cron and transfer large volumes of data by design
- Global organizations where 'off-hours' in one timezone is a normal working period for a distributed team or offshore operations center
- Scheduled ETL/data-warehouse pipelines that intentionally run overnight to avoid impacting daytime production workloads
- Software update or patch distribution systems (WSUS, SCCM, Intune) configured to push large payloads overnight
Other platforms for THREAT-Exfil-ScheduledBulkTransfer
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Scheduled Task and Simulate Off-Hours Bulk Upload
Expected signal: Windows Security Event ID 4698 (Scheduled Task Created) for 'df00tech-test-sync' with the encoded PowerShell command in the task action. Sysmon Event ID 1 for the powershell.exe process launched by the Task Scheduler engine (parent: svchost.exe / taskeng.exe). DeviceNetworkEvents/Sysmon Event ID 3 showing an outbound POST of ~120MB to the test endpoint.
- Test 2Cron-Based Scheduled Exfiltration on Linux
Expected signal: Auditd or Sysmon-for-Linux process execution events for `crontab`, followed at the scheduled time by `dd` and `curl` process creation events with the destination URL in the command line. Cron execution log entry in `/var/log/cron` or `journalctl -u cron` at 23:59.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ScheduledBulkTransfer — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-ArchiveStaging-ScheduledExfilScheduled Batch Exfiltration of Compressed Archive StagingUse for archive staging — rar/7z multi-volume splitting ahead of a timed transfer, typical of ransomware double-extortion.
- THREAT-CloudCLI-ScheduledExfilScheduled Transfer via Cloud Sync/Backup CLI ToolsUse for cloud CLI LOLBins — rclone, restic or azcopy launched by a scheduler rather than a human.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.