Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking.
Upgrade to ProDetect Uniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding) in Splunk
Adversaries and their implants frequently cap the amount of data sent per connection — either by splitting a large payload into fixed-size chunks (e.g., a 2048-byte send buffer in POSHSPY, 1500-byte chunks in OopsIE, a Cobalt Strike malleable C2 profile with a fixed max-size POST) or by padding beacon check-ins to a constant size to blend in with normal traffic. This produces a distinctive network-behavioral signature: many outbound connections from the same source to the same destination whose transferred-byte counts cluster tightly around one value, repeated far more often than legitimate bursty human- or application-driven traffic would produce. Rather than relying on endpoint visibility into the compression/scripting tool that performed the splitting (already covered by the base T1030 detection), this rule pivots purely on firewall/proxy flow volume — bucketing outbound byte counts and flagging source/destination pairs with repeated near-identical-size transfers within a short window, which is effective even against implants with no on-disk artifacts.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
index=firewall (sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="fortinet_fortigate")
| where bytes_out > 1024
| bin bytes_out span=1024 as SizeBucket
| stats count as TransferCount, sum(bytes_out) as TotalSentBytes, values(bytes_out) as SampleSizes, earliest(_time) as FirstSeen, latest(_time) as LastSeen by src_ip, dest_ip, dest_port, SizeBucket
| where TransferCount >= 5
| eval TotalSentMB=round(TotalSentBytes/1048576,2)
| eval WindowMinutes=round((LastSeen-FirstSeen)/60,2)
| eval AvgIntervalMinutes=round(WindowMinutes/TransferCount,2)
| eval FirstSeenReadable=strftime(FirstSeen,"%Y-%m-%d %H:%M:%S")
| table FirstSeenReadable, src_ip, dest_ip, dest_port, SizeBucket, TransferCount, TotalSentMB, WindowMinutes, AvgIntervalMinutes, SampleSizes
| sort - TransferCountBuckets firewall traffic-log bytes_out into 1KB-wide size buckets per source/destination/port and flags any pair with 5 or more transfers landing in the same bucket, surfacing the sample byte counts so an analyst can confirm true size uniformity — the same fixed-size-chunk/beacon-padding pattern as the KQL rule, applied to Palo Alto, Cisco ASA, or FortiGate traffic logs.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Monitoring/heartbeat agents sending fixed-size status payloads on a schedule
- VOIP or streaming sessions with constant packet/frame sizes
- API polling or webhook clients submitting a fixed-size body on a recurring interval
- Backup/cloud-sync clients legitimately uploading in fixed block sizes
Other platforms for THREAT-Exfiltration-UniformSizeBeaconChunking
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Fixed-Size Chunked Beacon Upload (Windows)
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents showing 6 outbound connections from powershell.exe to the test endpoint roughly 30 seconds apart. If routed through a monitored proxy or firewall, CommonSecurityLog/pan:traffic records showing 6 sessions with SentBytes clustering at ~8192 bytes.
- Test 2Cron/Loop-Based Fixed-Size Chunk Exfiltration (Linux)
Expected signal: Auditd or Sysmon-for-Linux process execution events for dd and curl repeated 6 times at ~30 second intervals. Firewall/proxy logs (CommonSecurityLog/pan:traffic) showing 6 sessions from the host with SentBytes at ~8192 bytes each.
- Test 3Fixed-Size File Chunk Upload Loop (macOS)
Expected signal: Endpoint Security framework (ES) process-exec events for curl and head repeated 6 times, plus network connection events (es_event_type_notify_open/network extensions or a monitoring proxy) showing 6 sessions with ~8192-byte outbound payloads.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.