Automated Exfiltration (T1020)

Tactic: Exfiltration · Platforms: Linux, macOS, Network Devices, Windows

The interactive view maps 1 detection strategy, 7 threat groups, 20 software entries, 3 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

Sub-techniques

• Traffic Duplication (T1020.001)

Explore

• Open T1020 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1020
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan