- AN1113 · Analytic 1113 — Detection of automated tools or scripts periodically transmitting data to external destinations using scheduled tasks or background processes.
- AN1114 · Analytic 1114 — Background scripts (e.g., via cron) or daemons transmitting data repeatedly to remote IPs or URLs.
- AN1115 · Analytic 1115 — Observation of LaunchAgents or LaunchDaemons establishing periodic external connections indicative of automated data transfer.
AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Automated Exfiltration
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Module 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · Tactic learning route · 24/100Infrastructure as code, CI/CD, artifact provenance, and policy as code
Cloud Security · Tactic learning route · 24/100
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Module 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · Tactic learning route · 24/100Infrastructure as code, CI/CD, artifact provenance, and policy as code
Cloud Security · Tactic learning route · 24/100
MITRE mitigations
No ATT&CK mitigation relationship is published for this technique. Apply risk-based controls and verify scope.