---
{
  "title": "Automated Exfiltration",
  "summary": "Automated exfiltration repeatedly transfers collected information without requiring manual action for each item.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1020"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1020: Automated Exfiltration",
      "url": "https://attack.mitre.org/techniques/T1020"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Automated exfiltration repeatedly transfers collected information without requiring manual action for each item. Timing and repeatability can reveal collection-to-transfer pipelines.


## An investigation example

A background process watches a directory and sends newly created files to an unapproved destination throughout the day.

## Evidence to examine

Correlate file changes, transfer timing, process persistence, destination history, and cumulative volume.

## A common analytical pitfall

Repeated uploads can be legitimate synchronization; purpose and authorization determine whether the activity is abusive.

## Response considerations

Stop confirmed unauthorized transfers, preserve affected file inventories, and assess the collection mechanism that feeds the automation.


## Repetition can be driven by an automated workflow

Automated exfiltration uses a process to collect and transfer information without requiring a separate manual action for every item. The mechanism may react to new data, scan selected locations, or operate repeatedly. Automation itself is not suspicious: backup, synchronization, and reporting systems use the same general pattern for legitimate purposes.

Investigators should identify inputs, trigger, executing identity, destination, and output. A process repeatedly reading files is not enough to establish export, and repeated connections do not reveal their contents automatically. Connect the stages through file, process, application, and network evidence where available.

## A fictional watched folder

An academy discovers an unfamiliar process that reads new files in a restricted folder and makes outbound requests soon afterward. Analysts compare the behavior with approved synchronization tools and preserve configuration, process ancestry, file events, and destination context. They assess whether successful transfer is demonstrated for each relevant period.

Containment should consider the automation's persistence and access path. Stopping one process may not remove a scheduled job, service, or other mechanism that restarts it. At the same time, disabling an approved synchronization service can disrupt work, so decisions need appropriate coordination and evidence.

## Describe an automated chain

Use fictional events for a new file, a process read, an archive update, and an upload response. Identify which observations support automation and which support successful movement. Add a benign backup workflow and compare the differences in authority and destination. There is no need to implement a real data-export mechanism.

A report should explain scope and gaps. Some records may show only selected files or sampled traffic, so do not assume every accessible document was transferred. The distinction between possible access and demonstrated movement helps responders make better exposure assessments and prioritize additional evidence collection.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]
- [[exfiltration-over-c2-channel]]
- [[exfiltration-over-alternative-protocol]]