MITRE ATT&CKtechnique

T1029 Scheduled Transfer

Published 2017-05-31 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Exfiltration
Platforms
Linux, macOS, Windows
Version
1.2
Created
2017-05-31

Description

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (18)

  • S1100 Ninja software (malware)
  • S1019 Shark software (malware)
  • S0696 Flagpro software (malware)
  • S0668 TinyTurla software (malware)
  • S0667 Chrommme software (malware)
  • S0596 ShadowPad software (malware)
  • G0126 Higaisa group
  • S0444 ShimRat software (malware)
  • S0409 Machete software (malware)
  • S0395 LightNeuron software (malware)
  • S0265 Kazuar software (malware)
  • S0283 jRAT software (malware)
  • S0200 Dipsind software (malware)
  • S0211 Linfo software (malware)
  • S0223 POWERSTATS software (malware)
  • S0154 Cobalt Strike software (malware)
  • S0045 ADVSTORESHELL software (malware)
  • S0126 ComRAT software (malware)

Referenced by Compliance · mitigates (8)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References