Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking.
Upgrade to ProDetect Uniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding) in Elastic Security
Adversaries and their implants frequently cap the amount of data sent per connection — either by splitting a large payload into fixed-size chunks (e.g., a 2048-byte send buffer in POSHSPY, 1500-byte chunks in OopsIE, a Cobalt Strike malleable C2 profile with a fixed max-size POST) or by padding beacon check-ins to a constant size to blend in with normal traffic. This produces a distinctive network-behavioral signature: many outbound connections from the same source to the same destination whose transferred-byte counts cluster tightly around one value, repeated far more often than legitimate bursty human- or application-driven traffic would produce. Rather than relying on endpoint visibility into the compression/scripting tool that performed the splitting (already covered by the base T1030 detection), this rule pivots purely on firewall/proxy flow volume — bucketing outbound byte counts and flagging source/destination pairs with repeated near-identical-size transfers within a short window, which is effective even against implants with no on-disk artifacts.
MITRE ATT&CK
- Tactic
- Exfiltration
Elastic Detection Query
sequence by source.ip, destination.ip with maxspan=30m
[network where event.type == "connection" and network.direction == "outbound" and network.bytes_sent >= 1024]
[network where event.type == "connection" and network.direction == "outbound" and network.bytes_sent >= 1024]
[network where event.type == "connection" and network.direction == "outbound" and network.bytes_sent >= 1024]Detects three or more outbound connections from the same source to the same destination within a 30-minute window, each transferring at least 1KB — a coarse EQL prefilter for repeated, size-limited transfers. Because EQL sequences cannot directly assert byte-level equality across steps, pair this rule with a downstream Kibana aggregation/threshold rule (bucketing network.bytes_sent) to confirm true size uniformity before alerting, consistent with the KQL/SPL SizeBucket approach.
Data Sources
Required Tables
False Positives & Tuning
- Monitoring/heartbeat agents with regular fixed-size check-ins
- VOIP/streaming sessions with constant packet framing
- Backup or cloud-sync agents uploading in fixed block sizes
Other platforms for THREAT-Exfiltration-UniformSizeBeaconChunking
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Fixed-Size Chunked Beacon Upload (Windows)
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents showing 6 outbound connections from powershell.exe to the test endpoint roughly 30 seconds apart. If routed through a monitored proxy or firewall, CommonSecurityLog/pan:traffic records showing 6 sessions with SentBytes clustering at ~8192 bytes.
- Test 2Cron/Loop-Based Fixed-Size Chunk Exfiltration (Linux)
Expected signal: Auditd or Sysmon-for-Linux process execution events for dd and curl repeated 6 times at ~30 second intervals. Firewall/proxy logs (CommonSecurityLog/pan:traffic) showing 6 sessions from the host with SentBytes at ~8192 bytes each.
- Test 3Fixed-Size File Chunk Upload Loop (macOS)
Expected signal: Endpoint Security framework (ES) process-exec events for curl and head repeated 6 times, plus network connection events (es_event_type_notify_open/network extensions or a monitoring proxy) showing 6 sessions with ~8192-byte outbound payloads.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.