Automated / scheduled / size-limited exfiltration

Chunked, timed transfers evade thresholds

categoryNetwork and infrastructure attacksseverityHighdetectabilityHighlabnot yet measured

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1020 · Exfiltration via Encrypted FTP · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1020 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1020 -TestGuids 5b380e96-b0ef-4072-8a8e-f194cb9eb9ac -TimeoutSeconds 120'

ATT&CK T1030 · Network-Based Data Transfer in Small Chunks · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1030 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1030 -TestGuids f0287b58-f4bc-40f6-87eb-692e126e7f8f -TimeoutSeconds 120'

Queued for lab measurement — not yet detonated.

Classification

27 values: 13 reviewed, 13 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Network attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Established

Impact & scope

Severity	High
Impact	Confidentiality
Platform	ESXiLinuxmacOSNetwork DevicesWindows
Environment	CloudOn-premises
Target asset class	Data store
Kill-chain phase (tactic)	Exfiltration

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Network Connection CreationNetwork Traffic FlowProcess CreationScheduled Job CreationScheduled Job Metadata

Detection & response

Mitigated by 10

M1031 attack-mitigation
D3-APCA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RTSD d3fend
D3-UGLPA d3fend

Detected by 15

DET0213 attack-detection-strategy
DET0397 attack-detection-strategy
DET0399 attack-detection-strategy
04ad83ef-1a37-4c10-b57a-81092164bf33 sigma
0c7686d5-c74e-4292-b224-2a08e956ebc4 sigma
2dad0cba-c62a-4a4f-949f-5f6ecd619769 sigma
457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c sigma
69b3bd1e-b38a-462f-9a23-fbdbf63d2294 sigma
6c220477-0b5b-4b25-bb90-66183b4089e8 sigma
7f2bb9d5-6395-4de5-969c-70c11fbe6b12 sigma
8a63cdd4-6207-414a-85bc-7e032bd3c1a2 sigma
c3f265c7-ff03-4056-8ab2-d486227b4599 sigma
c726e007-2cd0-4a55-abfb-79730fbedee5 sigma
d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb sigma
fbc5e92f-3044-4e73-a5c6-1c4359b539de sigma

Tested by 4

5b380e96-b0ef-4072-8a8e-f194cb9eb9ac atomic
9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0 atomic
ab936c51-10f4-46ce-9144-e02137b2016a atomic
f0287b58-f4bc-40f6-87eb-692e126e7f8f atomic

Framework references

Primary source: https://attack.mitre.org/tactics/TA0010/
attack: T1020 (primary)
attack: T1029
attack: T1030

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 211 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 18 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 21 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 31 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)