---
{
  "title": "Scheduled Transfer",
  "summary": "Scheduled transfer moves data at chosen times or intervals.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1029"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1029: Scheduled Transfer",
      "url": "https://attack.mitre.org/techniques/T1029"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Scheduled transfer moves data at chosen times or intervals. The schedule may reduce visibility or blend activity with existing business patterns.


## An investigation example

A suspicious staging directory is uploaded each night during the organization's normal backup window.

## Evidence to examine

Compare the task schedule, transferred content, destination ownership, and the responsible process with approved backup operations.

## A common analytical pitfall

Matching a backup window does not make a transfer approved, and nighttime activity is not automatically malicious.

## Response considerations

Verify the task owner and destination, preserve scheduling evidence, and interrupt confirmed unauthorized transfer without disrupting necessary recovery services.


## Timing can organize an unauthorized transfer

A transfer may be arranged to occur at a particular time or recurring interval. Scheduling can help coordinate activity or align it with expected traffic, but it is also normal for backups, synchronization, and reports. Investigate what initiates the transfer, which data it uses, and whether the destination and authority are approved.

A periodic network pattern alone does not establish a scheduled exfiltration mechanism. The apparent rhythm may come from application retries or an external polling service. Correlate task configuration, process events, file activity, and destination records. Preserve timezone and clock context before comparing timing across systems.

## A fictional overnight archive

An academy notices an archive created each evening and uploaded by an unfamiliar task. Analysts compare the task's creation history, owner, action, input paths, and destination with approved reporting jobs. The recurrence is useful context, while the archive's actual contents and successful upload require separate support.

Stopping a task may interrupt the immediate activity but can also affect legitimate operations if attribution is wrong. Preserve its definition and relevant logs where appropriate, coordinate containment, and investigate the access that created or altered it. A later schedule review may differ from the configuration active during the incident.

## Read a fictional schedule

Create a task record, file-creation event, and network event with different timezones. Normalize the sequence and identify which facts support a scheduled relationship. Add an approved backup as a comparison. Explain one uncertainty that prevents claiming a particular document was transferred.

Monitoring should examine purpose and destination rather than simply alert on after-hours traffic. Many organizations legitimately operate overnight workloads. A useful rule considers unexpected changes to a known schedule, a new owner, an unapproved recipient, or a mismatch between the task's stated role and the files it accesses.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]
- [[exfiltration-over-c2-channel]]
- [[exfiltration-over-alternative-protocol]]