Skip to content

T1029 Scheduled Transfer

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.

When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.

Item Value
ID T1029
Sub-techniques
Tactics TA0010
Platforms Linux, Windows, macOS
Version 1.1
Created 31 May 2017
Last Modified 28 March 2020

Procedure Examples

ID Name Description
S0045 ADVSTORESHELL ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.16
S0667 Chrommme Chrommme can set itself to sleep before requesting a new command from C2.4
S0154 Cobalt Strike Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.3
S0126 ComRAT ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).2
S0200 Dipsind Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.12
S0696 Flagpro Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.15
G0126 Higaisa Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.18
S0283 jRAT jRAT can be configured to reconnect at certain intervals.11
S0265 Kazuar Kazuar can sleep for a specific time and be set to communicate at specific intervals.10
S0395 LightNeuron LightNeuron can be configured to exfiltrate data during nighttime or working hours.14
S0211 Linfo Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.17
S0409 Machete Machete sends stolen data to the C2 server every 10 minutes.7
S0223 POWERSTATS POWERSTATS can sleep for a given number of seconds.5
S0596 ShadowPad ShadowPad has sent data back to C2 every 8 hours.8
S1019 Shark Shark can pause C2 communications for a specified time.13
S0444 ShimRat ShimRat can sleep when instructed to do so by the C2.6
S0668 TinyTurla TinyTurla contacts its C2 based on a scheduled timing set in its configuration.9

Mitigations

ID Mitigation Description
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. 1

Detection

ID Data Source Data Component
DS0029 Network Traffic Network Connection Creation

References

  1. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. ↩

  2. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. ↩

  3. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. ↩

  4. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021. ↩

  5. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018. ↩

  6. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020. ↩

  7. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019. ↩

  8. GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021. ↩

  9. Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021. ↩

  10. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018. ↩

  11. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019. ↩

  12. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018. ↩

  13. ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022. ↩

  14. Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019. ↩

  15. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. ↩

  16. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016. ↩

  17. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018. ↩

  18. PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021. ↩