Technique.View on attack.mitre.org
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.
When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.
Rules on DetectionCode tagged with T1029.
None recorded.
| Used by | Procedure example |
|---|---|
| GroupHigaisa | Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes. |
| Used by | Procedure example |
|---|---|
| MalwareADVSTORESHELL | ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes. |
| MalwareChrommme | Chrommme can set itself to sleep before requesting a new command from C2. |
| MalwareCobalt Strike | Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval. |
| MalwareComRAT | ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday). |
| MalwareDipsind | Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic. |
| MalwareFlagpro | Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2. |
| MalwarejRAT | jRAT can be configured to reconnect at certain intervals. |
| MalwareKazuar | Kazuar can sleep for a specific time and be set to communicate at specific intervals. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
