T1020Exfiltration
Automated Exfiltration
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
10 Sigma rules tagged T1020Automated ExfiltrationT102010 general rules
- Restore Public AWS RDS Instancehightest
- Modification or Deletion of an AWS RDS Clusterhighexperimental
- AWS RDS Master Password Changemediumtest
- Github Fork Private Repositories Setting Enabled/Clearedmediumtest
- Github Repository/Organization Transferredmediumtest
- Mail Forwarding/Redirecting Activity In O365mediumtest
- PowerShell Script With File Hostname Resolving Capabilitiesmediumtest
- Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdletmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Automated Exfiltration
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.