ATT&CK Reference
Portfolio

TA0010 · EXFILTRATION

Automated Exfiltration

T1020Linux · macOS · Windows · Network Devicesattack.mitre.org

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

Detect it with

Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.

Why it matters on shift

Automated Exfiltration is one of the concrete ways adversaries achieve exfiltration. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After exfiltration, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.

1 sub-techniques

How it shows up in practice

  1. T1020.001

    Traffic Duplication

    Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis.

Kill-chain context

← beforeCommand and ControlExfiltrationafter →Impact