# T1029 - Scheduled Transfer

## SOC Recommendation
Investigate Scheduled Transfer activity in the context of Exfiltration: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
```
```kql
let lookback = 2d;
let minFlows = 10;
let beaconPercentThreshold = 80.0;
Tailscale_Network_CL
| where TimeGenerated > ago(lookback)
| where HasVirtualTraffic
| mv-expand t = VirtualTraffic
| extend Src = tostring(t.src), Dst = tostring(t.dst), Proto = toint(t.proto)
| project TimeGenerated, Src, Dst, Proto, SrcNodeName, SrcUser, DstNodeName, DstUser
| sort by Src asc, Dst asc, Proto asc, TimeGenerated asc
| serialize
| extend NextTime = next(TimeGenerated), NextSrc = next(Src), NextDst = next(Dst), NextProto = next(Proto)
| where Src == NextSrc and Dst == NextDst and Proto == NextProto
| extend DeltaSec = datetime_diff('second', NextTime, TimeGenerated)
| where DeltaSec > 5
| summarize DeltaCount = count() by Src, Dst, Proto, DeltaSec, SrcNodeName, SrcUser, DstNodeName, DstUser
| summarize (MostFrequentDeltaCount, MostFrequentDeltaSec) = arg_max(DeltaCount, DeltaSec), TotalFlows = sum(DeltaCount) by Src, Dst, Proto, SrcNodeName, SrcUser, DstNodeName, DstUser
| where TotalFlows >= minFlows
| extend BeaconPercent = round(MostFrequentDeltaCount * 100.0 / TotalFlows, 1)
| where BeaconPercent >= beaconPercentThreshold
```

## Escalation Criteria
- Scheduled Transfer activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.