Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking.
Upgrade to ProDetect Uniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding) in Microsoft Sentinel
Adversaries and their implants frequently cap the amount of data sent per connection — either by splitting a large payload into fixed-size chunks (e.g., a 2048-byte send buffer in POSHSPY, 1500-byte chunks in OopsIE, a Cobalt Strike malleable C2 profile with a fixed max-size POST) or by padding beacon check-ins to a constant size to blend in with normal traffic. This produces a distinctive network-behavioral signature: many outbound connections from the same source to the same destination whose transferred-byte counts cluster tightly around one value, repeated far more often than legitimate bursty human- or application-driven traffic would produce. Rather than relying on endpoint visibility into the compression/scripting tool that performed the splitting (already covered by the base T1030 detection), this rule pivots purely on firewall/proxy flow volume — bucketing outbound byte counts and flagging source/destination pairs with repeated near-identical-size transfers within a short window, which is effective even against implants with no on-disk artifacts.
MITRE ATT&CK
- Tactic
- Exfiltration
KQL Detection Query
let LookBack = 24h;
let MinRepeats = 5;
let SizeToleranceBytes = 1024;
let MinChunkBytes = 1024; // ignore trivial keepalive/ACK-sized traffic
CommonSecurityLog
| where TimeGenerated > ago(LookBack)
| where SentBytes > MinChunkBytes
| extend SizeBucket = bin(SentBytes, SizeToleranceBytes)
| summarize
TransferCount = count(),
TotalSentMB = round(sum(SentBytes) / 1048576.0, 2),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
SampleSizes = make_set(SentBytes, 10)
by SourceIP, DestinationIP, DestinationPort, DeviceVendor, DeviceProduct, SizeBucket
| where TransferCount >= MinRepeats
| extend
WindowMinutes = round(datetime_diff("second", LastSeen, FirstSeen) / 60.0, 2),
AvgIntervalMinutes = round(datetime_diff("second", LastSeen, FirstSeen) / 60.0 / TransferCount, 2)
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DestinationPort, DeviceVendor, DeviceProduct, SizeBucket, TransferCount, TotalSentMB, WindowMinutes, AvgIntervalMinutes, SampleSizes
| sort by TransferCount descBuckets outbound firewall/proxy flow records (CommonSecurityLog SentBytes) into 1KB-wide size buckets per source/destination/port and flags any source-destination pair with 5 or more transfers landing in the same bucket within a 24-hour window — the network-flow signature of a fixed-size send buffer or padded beacon check-in used to keep individual transfers under a data-transfer threshold. SampleSizes is surfaced so an analyst can confirm true byte-level uniformity rather than a coincidental bucket collision.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate monitoring/heartbeat agents (APM, uptime checkers, IoT telemetry) that send fixed-size pings or status payloads on a regular interval
- VOIP, video conferencing, or streaming traffic with fixed packet/frame sizes that repeats for the duration of a call or stream
- API polling clients (webhooks, health checks, license-check-ins) that submit a fixed-size request body on a schedule
- Backup or cloud-sync agents (Rclone chunker, S3 multipart upload clients) that legitimately upload in fixed block sizes for transfer reliability — the same underlying technique used for benign engineering reasons
- Load balancer or CDN health-check probes sending uniform-size synthetic requests to backend pools
Other platforms for THREAT-Exfiltration-UniformSizeBeaconChunking
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Fixed-Size Chunked Beacon Upload (Windows)
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents showing 6 outbound connections from powershell.exe to the test endpoint roughly 30 seconds apart. If routed through a monitored proxy or firewall, CommonSecurityLog/pan:traffic records showing 6 sessions with SentBytes clustering at ~8192 bytes.
- Test 2Cron/Loop-Based Fixed-Size Chunk Exfiltration (Linux)
Expected signal: Auditd or Sysmon-for-Linux process execution events for dd and curl repeated 6 times at ~30 second intervals. Firewall/proxy logs (CommonSecurityLog/pan:traffic) showing 6 sessions from the host with SentBytes at ~8192 bytes each.
- Test 3Fixed-Size File Chunk Upload Loop (macOS)
Expected signal: Endpoint Security framework (ES) process-exec events for curl and head repeated 6 times, plus network connection events (es_event_type_notify_open/network extensions or a monitoring proxy) showing 6 sessions with ~8192-byte outbound payloads.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.