MITRE ATT&CKtechnique

T1020 Automated Exfiltration

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
Linux, macOS, Network Devices, Windows
Version
1.3
Created
2017-05-31

Description

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · subtechnique of (1)

  • T1020.001 Traffic Duplication sub-technique

Referenced by MITRE ATT&CK · uses (32)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0059 Salesforce Data Exfiltration campaign
  • S1211 Hannotog software (malware)
  • C0046 ArcaneDoor campaign
  • S1183 StrelaStealer software (malware)
  • S1166 Solar software (malware)
  • G1039 RedCurl group
  • S1148 Raccoon Stealer software (malware)
  • G1035 Winter Vivern group
  • C0001 Frankenstein campaign
  • S1017 OutSteel software (malware)
  • S0643 Peppy software (malware)
  • S0600 Doki software (malware)
  • G0121 Sidewinder group
  • S0538 Crutch software (malware)
  • S0491 StrongPity software (malware)
  • S0467 TajMahal software (malware)
  • S0445 ShimRatReporter software (tool)
  • S0438 Attor software (malware)
  • S0409 Machete software (malware)
  • G0094 Kimsuky group
  • S0395 LightNeuron software (malware)
  • S0377 Ebury software (malware)
  • S0363 Empire software (tool)
  • G0081 Tropic Trooper group
  • G0004 Ke3chang group
  • G0047 Gamaredon Group group
  • S0050 CosmicDuke software (malware)
  • S0090 Rover software (malware)
Show all 32 ›

References