T1029 · Scheduled Transfer

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1029 · Scheduled Transfer · Sunturai

attack-patternenterprise-attackT1029

Scheduled Transfer

attack-pattern--4eeaf8a9-c86b-4954-a663-9555fb406466

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.

Created: May 31, 2017, 9:30 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

4 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Tailscale Premium: Network flows outside business hours	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Tailscale Premium: Beaconing candidates (regular periodic flows)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Tailscale Premium: Network flow beaconing detected	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
OracleDBAudit - Connection to database from external IP	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 4 of 4

Filter in the catalogue

External references

mitre-attackT1029Open reference

Platforms

LinuxmacOSWindows

Kill chain phases

exfiltration

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object