kevmap

TechniquesT1029 › AN1119

AN1119 Analytic 1119

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detection of cron-based or script-based recurring transfers where the same script, user, or destination reappears at predictable intervals.</p>
Detects
T1029 Scheduled Transfer
Part of
DET0399 Detection Strategy for Scheduled Transfer and Recurrent Exfiltration Patterns

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLexecveDC0032 Process Creation
linux:croncron activityDC0005 Scheduled Job Metadata
NSM:FlowOutbound ConnectionsDC0082 Network Connection Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
ScriptPathRegexPath patterns for shell scripts responsible for scheduled transfers
CronIntervalThresholdMinimum repetition frequency (e.g., 24h for daily jobs)
ExfilUserContextSuspicious or unexpected users launching scheduled transfers