Automated Exfiltration
- ID
- T1020
- Tactics
- TA0010 Exfiltration
- Platforms
- Linux, macOS, Network Devices, Windows
- Data sources
- Process Creation, Network Connection Creation, Scheduled Job Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.[1]
When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
Sub-techniques (1)
Detection
- DET0397 Automated Exfiltration Detection Strategy
Data components: Process Creation, Network Connection Creation, Scheduled Job Creation
Groups (7)
- G0004 Ke3chang
- G0047 Gamaredon Group
- G0081 Tropic Trooper
- G0094 Kimsuky
- G0121 Sidewinder
- G1035 Winter Vivern
- G1039 RedCurl
Software (21)
- S0050 CosmicDuke
- S0090 Rover
- S0131 TINYTYPHON
- S0136 USBStealer
- S0363 Empire
- S0377 Ebury
- S0395 LightNeuron
- S0409 Machete
- S0438 Attor
- S0445 ShimRatReporter
- S0467 TajMahal
- S0491 StrongPity
- S0538 Crutch
- S0600 Doki
- S0643 Peppy
- S1017 OutSteel
- S1148 Raccoon Stealer
- S1166 Solar
- S1183 StrelaStealer
- S1211 Hannotog
- S9041 TeamPCP Cloud Stealer