tfMITRE ATT&CK technique

Scheduled Transfer T1029

Tactic: Exfiltration
Platforms: Linux, macOS, Windows
Version: 1.1
Created: 31 May 2017
Last modified: 24 October 2025

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 20%

Tools & malware80th percentile · 79% of ATT&CK techniques have fewer tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Offense vs defense T1029

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Scheduled Job MetadataDC0005	WinEventLog:System	EventCode=106, 200
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Scheduled Job MetadataDC0005

WinEventLog:System

EventCode=106, 200

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
TimeWindow	Duration threshold to consider a connection repetitive (e.g., same hour daily)
DestIPAllowlist	Known external destinations to exclude (e.g., approved SFTP/backup servers)
ParentProcessBaseline	Allowlisted job runners or scripts known to schedule legitimate transfers

Field

What you tune

TimeWindow

Duration threshold to consider a connection repetitive (e.g., same hour daily)

DestIPAllowlist

Known external destinations to exclude (e.g., approved SFTP/backup servers)

ParentProcessBaseline

Allowlisted job runners or scripts known to schedule legitimate transfers

Data component	Name	Channel
Scheduled Job MetadataDC0005	linux:cron	cron activity
Process CreationDC0032	auditd:SYSCALL	execve
Network Connection CreationDC0082	NSM:Flow	Outbound Connections

Field	What you tune
ScriptPathRegex	Path patterns for shell scripts responsible for scheduled transfers
CronIntervalThreshold	Minimum repetition frequency (e.g., 24h for daily jobs)
ExfilUserContext	Suspicious or unexpected users launching scheduled transfers

Data component	Name	Channel
Scheduled Job MetadataDC0005	macos:launchd	launchd.plist and logs
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
Network Traffic FlowDC0078	macos:unifiedlog	networkd or com.apple.network

Field	What you tune
AgentPathPatterns	Regex for job locations like ~/Library/LaunchAgents/
RepeatIntervalDelta	Time-based logic to determine schedule (e.g., ~24h ± 5m)
UserHomeJobs	Transfers originating from non-admin user context

ID	Name
D3-PLA	Process Lineage Analysis

Name

D3-PLA

Process Lineage Analysis

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Object

Action

Field

processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1

Offense vs defense T1029

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Scheduled Job MetadataDC0005	WinEventLog:System	EventCode=106, 200
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Scheduled Job MetadataDC0005

WinEventLog:System

EventCode=106, 200

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
TimeWindow	Duration threshold to consider a connection repetitive (e.g., same hour daily)
DestIPAllowlist	Known external destinations to exclude (e.g., approved SFTP/backup servers)
ParentProcessBaseline	Allowlisted job runners or scripts known to schedule legitimate transfers

Field

What you tune

TimeWindow

Duration threshold to consider a connection repetitive (e.g., same hour daily)

DestIPAllowlist

Known external destinations to exclude (e.g., approved SFTP/backup servers)

ParentProcessBaseline

Allowlisted job runners or scripts known to schedule legitimate transfers

Data component	Name	Channel
Scheduled Job MetadataDC0005	linux:cron	cron activity
Process CreationDC0032	auditd:SYSCALL	execve
Network Connection CreationDC0082	NSM:Flow	Outbound Connections

Field	What you tune
ScriptPathRegex	Path patterns for shell scripts responsible for scheduled transfers
CronIntervalThreshold	Minimum repetition frequency (e.g., 24h for daily jobs)
ExfilUserContext	Suspicious or unexpected users launching scheduled transfers

Data component	Name	Channel
Scheduled Job MetadataDC0005	macos:launchd	launchd.plist and logs
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
Network Traffic FlowDC0078	macos:unifiedlog	networkd or com.apple.network

Field	What you tune
AgentPathPatterns	Regex for job locations like ~/Library/LaunchAgents/
RepeatIntervalDelta	Time-based logic to determine schedule (e.g., ~24h ± 5m)
UserHomeJobs	Transfers originating from non-admin user context