{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1020","id":"T1020","name":"Automated Exfiltration","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1020","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"516ec00fd788bd65afd9bdeac77d419ed3a2502e15c3a0a581d732a2cfa3ea1e","description":"Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) \n\nWhen automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1020","external_id":"T1020"},{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}],"platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1020.001","id":"T1020.001","name":"Traffic Duplication","page":"techniques/enterprise/T1020.001/"}],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0001","name":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a scheduled execution object, including its trigger, principal and executable action.","collection_focus":"Enable Audit Other Object Access Events for Windows task creation (4698); retain task XML. For cron/systemd timers, collect scheduler definitions and change events separately.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["task_name","action","principal","schedule","program"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1020","id":"T1020","name":"Automated Exfiltration","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T1020","technique_page":"techniques/enterprise/T1020/","page":"detections/enterprise/T1020/","status":"rule_source_available","counts":{"sigma":8,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"69b3bd1e-b38a-462f-9a23-fbdbf63d2294","title":"Github Fork Private Repositories Setting Enabled/Cleared","status":"test","level":"medium","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/69b3bd1e-b38a-462f-9a23-fbdbf63d2294.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_fork_private_repos_enabled_or_cleared.yml","author":"Romain Gaillard (@romain-gaillard)","kind":"sigma"},{"id":"04ad83ef-1a37-4c10-b57a-81092164bf33","title":"Github Repository/Organization Transferred","status":"test","level":"medium","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/04ad83ef-1a37-4c10-b57a-81092164bf33.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_repo_or_org_transferred.yml","author":"Romain Gaillard (@romain-gaillard)","kind":"sigma"},{"id":"8a63cdd4-6207-414a-85bc-7e032bd3c1a2","title":"AWS RDS Master Password Change","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/8a63cdd4-6207-414a-85bc-7e032bd3c1a2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_rds_change_master_password.yml","author":"faloker","kind":"sigma"},{"id":"457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c","title":"Modification or Deletion of an AWS RDS Cluster","status":"experimental","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml","author":"Ivan Saakov","kind":"sigma"},{"id":"c3f265c7-ff03-4056-8ab2-d486227b4599","title":"Restore Public AWS RDS Instance","status":"test","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/c3f265c7-ff03-4056-8ab2-d486227b4599.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml","author":"faloker","kind":"sigma"},{"id":"6c220477-0b5b-4b25-bb90-66183b4089e8","title":"Suspicious Inbox Forwarding","status":"test","level":"low","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/6c220477-0b5b-4b25-bb90-66183b4089e8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"fbc5e92f-3044-4e73-a5c6-1c4359b539de","title":"PowerShell Script With File Hostname Resolving Capabilities","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"},"data_path":"data/detection-rules/fbc5e92f-3044-4e73-a5c6-1c4359b539de.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb","title":"PowerShell Script With File Upload Capabilities","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"},"data_path":"data/detection-rules/d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1020-1","technique_id":"T1020","title":"T1020 Automated Exfiltration","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#exfiltration","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":181,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L181","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"458698bdca09bc13aa5fa5595c1cc57c896558ef2a00de83a7e2653be51d52b6","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(scheduled_or_automated_transfer_job) AND destination NOT_IN approved_destinations -> ALERT","log_sources":[{"title":"Scheduled Task and Job Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#17-scheduled-task-and-job-logs"},{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"File Transfer Service Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#90-file-transfer-service-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0397","name":"Automated Exfiltration Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0397","stix_id":"x-mitre-detection-strategy--da5ff985-fd0d-438f-8498-c8dc195f741a","relationship_id":"relationship--38c1f601-496a-4dcd-8109-176c544ab800","description":"","analytics":[{"id":"AN1113","name":"Analytic 1113","guidance":"Detection of automated tools or scripts periodically transmitting data to external destinations using scheduled tasks or background processes.","url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1113","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Used to detect repeated exfil activity over intervals (e.g., every 5 minutes)."},{"field":"DestinationIP","description":"Can be tuned to filter known internal or trusted destinations."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1113","source_url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1113","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1113","source_url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1113","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1114","name":"Analytic 1114","guidance":"Background scripts (e.g., via cron) or daemons transmitting data repeatedly to remote IPs or URLs.","url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1114","platforms":["Linux"],"tuning":[{"field":"CronJobInterval","description":"Tunable time range for recurring tasks seen creating outbound connections."},{"field":"UserContext","description":"Tunable for scope — service accounts vs user accounts."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1114","source_url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1114","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"Outbound Connections","platforms":["Linux"],"analytic_id":"AN1114","source_url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1114","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1115","name":"Analytic 1115","guidance":"Observation of LaunchAgents or LaunchDaemons establishing periodic external connections indicative of automated data transfer.","url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1115","platforms":["macOS"],"tuning":[{"field":"LaunchInterval","description":"Frequency of task recurrence linked to external communication."},{"field":"DestinationPort","description":"Port number used for detection filtering."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process: exec","platforms":["macOS"],"analytic_id":"AN1115","source_url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1115","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"macos:unifiedlog","channel":"network","platforms":["macOS"],"analytic_id":"AN1115","source_url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1115","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0001","component":"Scheduled Job Creation","name":"macos:cron","channel":"cron/launchd","platforms":["macOS"],"analytic_id":"AN1115","source_url":"https://attack.mitre.org/detectionstrategies/DET0397#AN1115","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0001","name":"Scheduled Job Creation","tag":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0050","name":"CosmicDuke","url":"https://attack.mitre.org/software/S0050","kind":"malware","description":"[CosmicDuke](https://attack.mitre.org/software/S0050) exfiltrates collected files automatically over FTP to remote servers.(Citation: F-Secure Cosmicduke)","relationship_id":"relationship--d8ac067b-f246-40bb-98bd-fcff74092139","references":[{"source_name":"F-Secure Cosmicduke","description":"F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}]},{"id":"S0090","name":"Rover","url":"https://attack.mitre.org/software/S0090","kind":"malware","description":"[Rover](https://attack.mitre.org/software/S0090) automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. [Rover](https://attack.mitre.org/software/S0090) also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.(Citation: Palo Alto Rover)","relationship_id":"relationship--59261bc8-0220-4e37-8018-7a3618a5dd1b","references":[{"source_name":"Palo Alto Rover","description":"Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}]},{"id":"S0131","name":"TINYTYPHON","url":"https://attack.mitre.org/software/S0131","kind":"malware","description":"When a document is found matching one of the extensions in the configuration, [TINYTYPHON](https://attack.mitre.org/software/S0131) uploads it to the C2 server.(Citation: Forcepoint Monsoon)","relationship_id":"relationship--ff922dd7-21b6-4f95-bb8b-080d0dee6655","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}]},{"id":"S0136","name":"USBStealer","url":"https://attack.mitre.org/software/S0136","kind":"malware","description":"[USBStealer](https://attack.mitre.org/software/S0136) automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine. (Citation: ESET Sednit USBStealer 2014)","relationship_id":"relationship--ae8a95fa-c0ad-40b4-a573-a9441ed94fab","references":[{"source_name":"ESET Sednit USBStealer 2014","description":"Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) has the ability to automatically send collected data back to the threat actors' C2.(Citation: Talos Frankenstein June 2019)","relationship_id":"relationship--45608b9a-ddd8-45f9-9152-bed384a1c8c3","references":[{"source_name":"Talos Frankenstein June 2019","description":"Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}]},{"id":"S0377","name":"Ebury","url":"https://attack.mitre.org/software/S0377","kind":"malware","description":"If credentials are not collected for two weeks, [Ebury](https://attack.mitre.org/software/S0377) encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.(Citation: ESET Windigo Mar 2014)(Citation: ESET Ebury May 2024)","relationship_id":"relationship--6ff6558d-3efb-4219-8d47-ecf82755ccf1","references":[{"source_name":"ESET Windigo Mar 2014","description":"Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021.","url":"https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"},{"source_name":"ESET Ebury May 2024","description":"Marc-Etienne M.Léveillé. (2024, May 1). Ebury is alive but unseen. Retrieved May 21, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf"}]},{"id":"S0395","name":"LightNeuron","url":"https://attack.mitre.org/software/S0395","kind":"malware","description":"[LightNeuron](https://attack.mitre.org/software/S0395) can be configured to automatically exfiltrate files under a specified directory.(Citation: ESET LightNeuron May 2019)","relationship_id":"relationship--2b1fb532-84e3-4f77-962c-038c798d239e","references":[{"source_name":"ESET LightNeuron May 2019","description":"Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409)’s collected files are exfiltrated automatically to remote servers.(Citation: ESET Machete July 2019) ","relationship_id":"relationship--6cf0d062-e441-48ca-b675-2f01ae333b74","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438) has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--f49a45b8-6efb-4ac5-8714-9dfd9b31edbd","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0445","name":"ShimRatReporter","url":"https://attack.mitre.org/software/S0445","kind":"tool","description":"[ShimRatReporter](https://attack.mitre.org/software/S0445) sent collected system and network information compiled into a report to an adversary-controlled C2.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--d894e46e-1967-4499-83d5-626a8e49a97a","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to manage an automated queue of egress files and commands sent to its C2.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--9cc4cd5d-7b10-4dd7-8fd9-90288aa8b5be","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0491","name":"StrongPity","url":"https://attack.mitre.org/software/S0491","kind":"malware","description":"[StrongPity](https://attack.mitre.org/software/S0491) can automatically exfiltrate collected documents to the C2 server.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)","relationship_id":"relationship--0e3ea008-1a5e-4f58-aaa9-4da690539908","references":[{"source_name":"Talos Promethium June 2020","description":"Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source_name":"Bitdefender StrongPity June 2020","description":"Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"id":"S0538","name":"Crutch","url":"https://attack.mitre.org/software/S0538","kind":"malware","description":"[Crutch](https://attack.mitre.org/software/S0538) has automatically exfiltrated stolen files to Dropbox.(Citation: ESET Crutch December 2020)","relationship_id":"relationship--be7f2951-ce33-4d48-ad9c-69071e54ae18","references":[{"source_name":"ESET Crutch December 2020","description":"Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}]},{"id":"S0600","name":"Doki","url":"https://attack.mitre.org/software/S0600","kind":"malware","description":"[Doki](https://attack.mitre.org/software/S0600) has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.(Citation: Intezer Doki July 20)","relationship_id":"relationship--4a007e42-2efb-4ace-aa08-950bbee11df7","references":[{"source_name":"Intezer Doki July 20","description":"Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}]},{"id":"S0643","name":"Peppy","url":"https://attack.mitre.org/software/S0643","kind":"malware","description":"[Peppy](https://attack.mitre.org/software/S0643) has the ability to automatically exfiltrate files and keylogs.(Citation: Proofpoint Operation Transparent Tribe March 2016)","relationship_id":"relationship--672f33f6-bdc1-40b2-a208-888d1002cc25","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"id":"S1017","name":"OutSteel","url":"https://attack.mitre.org/software/S1017","kind":"malware","description":"[OutSteel](https://attack.mitre.org/software/S1017) can automatically upload collected files to its C2 server.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--667592ad-e249-4efd-933f-75a53b25567a","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--72513bb1-7e36-415f-a6bd-4b1a908509ef","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"Sekoia Raccoon1 2022","description":"Quentin Bourgue, Pierre le Bourhis, & Sekoia TDR. (2022, June 28). Raccoon Stealer v2 - Part 1: The return of the dead. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"},{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1166","name":"Solar","url":"https://attack.mitre.org/software/S1166","kind":"malware","description":"[Solar](https://attack.mitre.org/software/S1166) can automatically exfitrate files from compromised systems.(Citation: ESET OilRig Campaigns Sep 2023)","relationship_id":"relationship--73df85c1-c019-4d73-9c1d-98faea3d48c2","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) automatically sends gathered email credentials following collection to command and control servers via HTTP POST.(Citation: DCSO StrelaStealer 2022)(Citation: IBM StrelaStealer 2024)","relationship_id":"relationship--f7539748-0911-4a98-a98f-f512d1424d85","references":[{"source_name":"DCSO StrelaStealer 2022","description":"DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.","url":"https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"},{"source_name":"IBM StrelaStealer 2024","description":"Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}]},{"id":"S1211","name":"Hannotog","url":"https://attack.mitre.org/software/S1211","kind":"malware","description":"[Hannotog](https://attack.mitre.org/software/S1211) can upload encyrpted data for exfiltration.(Citation: Symantec Bilbug 2022)","relationship_id":"relationship--75fc48f0-fafe-45b8-aeae-53e26487e642","references":[{"source_name":"Symantec Bilbug 2022","description":"Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can compress and encrypt data and exfiltrate it via POST to scan.aquasecurtiy[.]org. If that method fails it attempts to use a stolen GITHUB_TOKEN to create a repo and exfiltrate the data there.(Citation: Wiz Trivy Compromise MAR 2026)","relationship_id":"relationship--ace245e2-6972-4247-9b08-4c6a375cfce7","references":[{"source_name":"Wiz Trivy Compromise MAR 2026","description":"McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) has performed  frequent and scheduled data exfiltration from compromised networks.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--78ad31db-6b8e-4433-88b8-49c22994a2ab","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used modules that automatically upload gathered documents to the C2 server.(Citation: ESET Gamaredon June 2020)","relationship_id":"relationship--c623d41f-3af0-4e3a-bf4f-8550bec85b37","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.(Citation: TrendMicro Tropic Trooper May 2020)\t","relationship_id":"relationship--c4f1371c-8f23-49b7-9572-d226ee2dbade","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has exfiltrated data to C2 servers using an automated script that executes every 10 minutes and after successful checks for the presence of pre-designated staged filenames.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--1a853e5a-1529-4ac0-8c17-48461e29c4ca","references":[{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0121","name":"Sidewinder","url":"https://attack.mitre.org/groups/G0121","kind":"intrusion-set","description":"[Sidewinder](https://attack.mitre.org/groups/G0121) has configured tools to automatically send collected files to attacker controlled servers.(Citation: ATT Sidewinder January 2021)","relationship_id":"relationship--3d2736f6-5ce8-48ba-8be0-e8d8ab0a3a9c","references":[{"source_name":"ATT Sidewinder January 2021","description":"Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.(Citation: CERT-UA WinterVivern 2023)","relationship_id":"relationship--a16a3223-06a6-453d-b044-f683bda1bf2a","references":[{"source_name":"CERT-UA WinterVivern 2023","description":"CERT-UA. (2023, February 1). UAC-0114 aka Winter Vivern to target Ukrainian and Polish GOV entities (CERT-UA#5909). Retrieved July 29, 2024.","url":"https://cert.gov.ua/article/3761104"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has used batch scripts to exfiltrate data.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)","relationship_id":"relationship--94149a91-d3c4-4893-938d-4f8964aeb5d7","references":[{"source_name":"group-ib_redcurl1","description":"Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","description":"Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]}],"mitigations":[],"candidates":[{"id":"5b380e96-b0ef-4072-8a8e-f194cb9eb9ac","name":"Exfiltration via Encrypted FTP","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1020/T1020.yaml","description":"Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.","inputs":{"sampleFile":{"description":"Path of the sample file to exfiltrate.","type":"String","default":"C:\\temp\\T1020__FTP_sample.txt"},"ftpServer":{"description":"FTP server URL.","type":"Url","default":"ftp://example.com"},"credentials":{"description":"FTP server credentials.","type":"String","default":"[user:password]"}},"dependencies":[],"source_definition_sha256":"0f90eeff449071efbf2596bb25843da405d194811128d537e89bf522213da7b4"},{"id":"9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0","name":"IcedID Botnet HTTP PUT","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1020/T1020.yaml","description":"Creates a text file\nTries to upload to a server via HTTP PUT method with ContentType Header\nDeletes a created file","inputs":{"file":{"description":"Exfiltration File","type":"string","default":"C:\\temp\\T1020_exfilFile.txt"},"domain":{"description":"Destination Domain","type":"url","default":"https://google.com"}},"dependencies":[],"source_definition_sha256":"9a22aa1fa136c6bc531dd160d3f6bac29cfe964d297ba1428f5b05efc19cdb75"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1041":"/ttp-simulation/techniques/enterprise/T1041/","T1048":"/ttp-simulation/techniques/enterprise/T1048/","T1020":"/ttp-simulation/techniques/enterprise/T1020/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1020","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}}]}}