Scheduled Transfer
Scheduled transfer moves data at chosen times or intervals.
What it means
Scheduled transfer moves data at chosen times or intervals. The schedule may reduce visibility or blend activity with existing business patterns.
An investigation example
A suspicious staging directory is uploaded each night during the organization's normal backup window.
Evidence to examine
Compare the task schedule, transferred content, destination ownership, and the responsible process with approved backup operations.
A common analytical pitfall
Matching a backup window does not make a transfer approved, and nighttime activity is not automatically malicious.
Response considerations
Verify the task owner and destination, preserve scheduling evidence, and interrupt confirmed unauthorized transfer without disrupting necessary recovery services.
Timing can organize an unauthorized transfer
A transfer may be arranged to occur at a particular time or recurring interval. Scheduling can help coordinate activity or align it with expected traffic, but it is also normal for backups, synchronization, and reports. Investigate what initiates the transfer, which data it uses, and whether the destination and authority are approved.
A periodic network pattern alone does not establish a scheduled exfiltration mechanism. The apparent rhythm may come from application retries or an external polling service. Correlate task configuration, process events, file activity, and destination records. Preserve timezone and clock context before comparing timing across systems.
A fictional overnight archive
An academy notices an archive created each evening and uploaded by an unfamiliar task. Analysts compare the task's creation history, owner, action, input paths, and destination with approved reporting jobs. The recurrence is useful context, while the archive's actual contents and successful upload require separate support.
Stopping a task may interrupt the immediate activity but can also affect legitimate operations if attribution is wrong. Preserve its definition and relevant logs where appropriate, coordinate containment, and investigate the access that created or altered it. A later schedule review may differ from the configuration active during the incident.
Read a fictional schedule
Create a task record, file-creation event, and network event with different timezones. Normalize the sequence and identify which facts support a scheduled relationship. Add an approved backup as a comparison. Explain one uncertainty that prevents claiming a particular document was transferred.
Monitoring should examine purpose and destination rather than simply alert on after-hours traffic. Many organizations legitimately operate overnight workloads. A useful rule considers unexpected changes to a known schedule, a new owner, an unapproved recipient, or a mismatch between the task's stated role and the files it accesses.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1029: Scheduled Transfer