T1029 — Scheduled Transfer

Tactic: Exfiltration · Platforms: Linux, macOS, Windows

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer…

Sigma detection rules (3)

T1029 Scheduled Transfer

title: T1029 Scheduled Transfer
id: d02d4fe6-ef21-4dd8-bf56-c221e881eb4a
description: 'Detects outbound network connections from script/remote-transfer interpreters, the candidate transfer events which the paired correlation rule below evaluates for scheduled/recurring timing — a single Sysmon NetworkConnect event cannot show interval or periodicity on its own. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, DestIPAllowlist, ParentProcessBaseline.'
references:
  - https://attack.mitre.org/techniques/T1029
author: Shahrukh Khan
date: 2026-05-26
license: MIT
tags:
  - attack.exfiltration
  - attack.t1029

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate scripted update/monitoring jobs that make periodic outbound calls from these interpreters; this base rule only flags candidate transfer events — pair with the correlation rule below (grouping by Image and DestinationIp over a multi-hour window) before escalating, and tune DestIPAllowlist for known SaaS/update endpoints.

level: medium
---
title: T1029 Scheduled Transfer - Recurring Interval Correlation
id: 7c82e416-75f0-4f89-b75f-f7580d4d2398
status: experimental
description: 'Companion correlation rule for d02d4fe6-ef21-4dd8-bf56-c221e881eb4a — flags the same script interpreter repeatedly connecting to the same external destination at regular intervals, the "scheduled" signal that a single network_connection event cannot express on its own.'
references:
  - https://attack.mitre.org/techniques/T1029
author: Shahrukh Khan
date: 2026-05-26
license: MIT
tags:
  - attack.exfiltration
  - attack.t1029
correlation:
  type: event_count
  rules:
    - d02d4fe6-ef21-4dd8-bf56-c221e881eb4a
  group-by:
    - Image
    - DestinationIp
  timespan: 6h
  condition:
    gte: 4
level: medium

T1029 Scheduled Transfer

title: T1029 Scheduled Transfer
id: c8105d25-3995-4142-8680-3b29c4a243c8
description: 'Detection Strategy for Scheduled Transfer and Recurrent Exfiltration Patterns. Using auid unset as a proxy for cron/non-interactive origin only confirms non-interactive execution, not any recurring/periodic pattern, so the base rule alone just flags any cron-launched transfer tool rather than a genuinely scheduled transfer. The companion correlation rule below requires the same transfer binary to recur across multiple distinct days within a rolling window, approximating the recurring/scheduled behavior a single event cannot establish. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptPathRegex, CronIntervalThreshold, ExfilUserContext.'
references:
  - https://attack.mitre.org/techniques/T1029
author: Shahrukh Khan
date: 2026-03-24
license: MIT
tags:
  - attack.exfiltration
  - attack.t1029

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: SYSCALL
    syscall: execve
    exe|endswith:
      - '/curl'
      - '/scp'
      - '/rsync'
    auid: '4294967295'
  condition: selection

falsepositives:
  - Any cron-launched job using these transfer tools matches this base selection; treat as informational unless the companion correlation rule below (recurrence across multiple days) also fires, since a single legitimate scheduled backup run will not cross that threshold.

level: low
---
title: T1029 Scheduled Transfer - Recurring Non-Interactive Transfer Pattern
id: 4d7c8e2b-1a9f-4c6d-8b3e-5f0a2d9c7b16
description: 'Correlation companion for c8105d25-3995-4142-8680-3b29c4a243c8: counts non-interactive curl/scp/rsync executions from the same exe across a 72-hour window, approximating a genuinely recurring/scheduled transfer pattern rather than a single cron-launched job.'
status: experimental
correlation:
  type: event_count
  rules:
    - c8105d25-3995-4142-8680-3b29c4a243c8
  group-by:
    - exe
  timespan: 72h
  condition:
    gte: 3
level: medium

T1029 Scheduled Transfer

title: T1029 Scheduled Transfer
id: 7935f31e-4178-42f9-86ad-b4e9c91f85bf
description: 'Detection Strategy for Scheduled Transfer and Recurrent Exfiltration Patterns. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AgentPathPatterns, RepeatIntervalDelta, UserHomeJobs.'
references:
  - https://attack.mitre.org/techniques/T1029
author: Shahrukh Khan
date: 2026-02-23
license: MIT
tags:
  - attack.exfiltration
  - attack.t1029

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains: '/Library/LaunchAgents/'
  selection_net:
    CommandLine|contains:
      - 'curl'
      - 'scp'
      - 'ditto'
  condition: selection and selection_net

falsepositives:
  - Legitimate scheduled backup or sync agents installed as per-user LaunchAgents.

level: medium

Explore