T1020 Automated Exfiltration — Detection Rules

Source-backed rule directory

• Github Fork Private Repositories Setting Enabled/Cleared · test · medium · {"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"}
• Github Repository/Organization Transferred · test · medium · {"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"}
• AWS RDS Master Password Change · test · medium · {"product":"aws","service":"cloudtrail"}
• Modification or Deletion of an AWS RDS Cluster · experimental · high · {"product":"aws","service":"cloudtrail"}
• Restore Public AWS RDS Instance · test · high · {"product":"aws","service":"cloudtrail"}
• Suspicious Inbox Forwarding · test · low · {"service":"threat_management","product":"m365"}
• PowerShell Script With File Hostname Resolving Capabilities · test · medium · {"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"}
• PowerShell Script With File Upload Capabilities · test · low · {"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"}

Atlas deterministic concepts

T1020 Automated Exfiltration

MATCH(scheduled_or_automated_transfer_job) AND destination NOT_IN approved_destinations -> ALERT

• Scheduled Task and Job Logs
• Network Flow Logs
• File Transfer Service Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0397 Automated Exfiltration Detection Strategy

AN1113 Analytic 1113

Detection of automated tools or scripts periodically transmitting data to external destinations using scheduled tasks or background processes.

AN1114 Analytic 1114

Background scripts (e.g., via cron) or daemons transmitting data repeatedly to remote IPs or URLs.

AN1115 Analytic 1115

Observation of LaunchAgents or LaunchDaemons establishing periodic external connections indicative of automated data transfer.