T1020 · Automated Exfiltration

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1020 · Automated Exfiltration · Sunturai

attack-patternenterprise-attackT1020

Automated Exfiltration

attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020) When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

1 sub-technique under this technique

Each is its own technique in the catalogue, with its own detections.

T1020.001Traffic Duplication

61 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Detect Renamed RClone	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
M365 OneDrive/SharePoint Excessive File Downloads	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
High Number of Protected Branch Force Pushes by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Several Failed Protected Branch Force Pushes by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
High Number of Closed Pull Requests by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
GitHub Exfiltration via High Number of Repository Clones by User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
GitHub Private Repository Turned Public	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS EC2 Full Network Packet Capture Detected	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Cisco Cloud Security - Hack Tool User-Agent Detected	Medium	—	Sep 4, 2026	MIT License
NRT Multiple users email forwarded to same destination	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Users searching for VIP user activity	Low	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
A host is potentially running a hacking tool (ASIM Web Session schema)	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Progress MOVEIt File transfer folder count above threshold	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Progress MOVEIt File transfer above threshold	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Tailscale Premium: Large outbound transfer over tailnet	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
SFTP File transfer folder count above threshold	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
SFTP File transfer above threshold	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Outbound SSH/SCP Connections	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
SlackAudit - Uploaded files stats	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Azure secure score integrated apps	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Third party integrated apps	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 25 of 61

Filter in the catalogue

External references

mitre-attackT1020Open reference

ESET Gamaredon June 2020Open reference

Platforms

LinuxmacOSNetwork DevicesWindows

Kill chain phases

exfiltration

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object