Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking.
Upgrade to ProDetect Uniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding) in IBM QRadar
Adversaries and their implants frequently cap the amount of data sent per connection — either by splitting a large payload into fixed-size chunks (e.g., a 2048-byte send buffer in POSHSPY, 1500-byte chunks in OopsIE, a Cobalt Strike malleable C2 profile with a fixed max-size POST) or by padding beacon check-ins to a constant size to blend in with normal traffic. This produces a distinctive network-behavioral signature: many outbound connections from the same source to the same destination whose transferred-byte counts cluster tightly around one value, repeated far more often than legitimate bursty human- or application-driven traffic would produce. Rather than relying on endpoint visibility into the compression/scripting tool that performed the splitting (already covered by the base T1030 detection), this rule pivots purely on firewall/proxy flow volume — bucketing outbound byte counts and flagging source/destination pairs with repeated near-identical-size transfers within a short window, which is effective even against implants with no on-disk artifacts.
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS FirstSeen,
sourceip AS SourceIP,
destinationip AS DestinationIP,
destinationport AS DestinationPort,
LONG("BytesSent") AS BytesSent,
COUNT(*) AS TransferCount
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Netflow', 'Palo Alto Networks Firewall', 'Cisco ASA')
AND starttime > NOW() - 1 DAYS
AND LONG("BytesSent") > 1024
GROUP BY sourceip, destinationip, destinationport, BytesSent
HAVING COUNT(*) >= 5
ORDER BY TransferCount DESCQRadar AQL query grouping outbound flow records by exact SentBytes value per source/destination/port and flagging groups with 5 or more repeats within 24 hours — an exact-match variant of the bucketed KQL/SPL approach, suited to QRadar's aggregate-then-filter query model.
Data Sources
Required Tables
False Positives & Tuning
- Monitoring agents or health-check probes sending fixed-size payloads on a schedule
- Backup/cloud-sync clients uploading in fixed block sizes
Other platforms for THREAT-Exfiltration-UniformSizeBeaconChunking
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Fixed-Size Chunked Beacon Upload (Windows)
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents showing 6 outbound connections from powershell.exe to the test endpoint roughly 30 seconds apart. If routed through a monitored proxy or firewall, CommonSecurityLog/pan:traffic records showing 6 sessions with SentBytes clustering at ~8192 bytes.
- Test 2Cron/Loop-Based Fixed-Size Chunk Exfiltration (Linux)
Expected signal: Auditd or Sysmon-for-Linux process execution events for dd and curl repeated 6 times at ~30 second intervals. Firewall/proxy logs (CommonSecurityLog/pan:traffic) showing 6 sessions from the host with SentBytes at ~8192 bytes each.
- Test 3Fixed-Size File Chunk Upload Loop (macOS)
Expected signal: Endpoint Security framework (ES) process-exec events for curl and head repeated 6 times, plus network connection events (es_event_type_notify_open/network extensions or a monitoring proxy) showing 6 sessions with ~8192-byte outbound payloads.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.