Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking.
Upgrade to ProDetect Uniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding) in Sumo Logic CSE
Adversaries and their implants frequently cap the amount of data sent per connection — either by splitting a large payload into fixed-size chunks (e.g., a 2048-byte send buffer in POSHSPY, 1500-byte chunks in OopsIE, a Cobalt Strike malleable C2 profile with a fixed max-size POST) or by padding beacon check-ins to a constant size to blend in with normal traffic. This produces a distinctive network-behavioral signature: many outbound connections from the same source to the same destination whose transferred-byte counts cluster tightly around one value, repeated far more often than legitimate bursty human- or application-driven traffic would produce. Rather than relying on endpoint visibility into the compression/scripting tool that performed the splitting (already covered by the base T1030 detection), this rule pivots purely on firewall/proxy flow volume — bucketing outbound byte counts and flagging source/destination pairs with repeated near-identical-size transfers within a short window, which is effective even against implants with no on-disk artifacts.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
_sourceCategory="network/firewall"
| where bytes_out > 1024
| eval SizeBucket=round(bytes_out/1024)*1024
| sum(bytes_out) as TotalBytes, count as TransferCount by src_ip, dest_ip, dest_port, SizeBucket
| where TransferCount >= 5
| sort - TransferCountSumo Logic query bucketing firewall flow records into 1KB-wide size buckets per source/destination/port and flagging pairs with 5 or more transfers in the same bucket, identifying candidate fixed-size chunk/beacon exfiltration under T1030.
Data Sources
Required Tables
False Positives & Tuning
- Monitoring/heartbeat agents with fixed-size check-ins
- Backup or cloud-sync clients uploading in fixed block sizes
Other platforms for THREAT-Exfiltration-UniformSizeBeaconChunking
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Fixed-Size Chunked Beacon Upload (Windows)
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents showing 6 outbound connections from powershell.exe to the test endpoint roughly 30 seconds apart. If routed through a monitored proxy or firewall, CommonSecurityLog/pan:traffic records showing 6 sessions with SentBytes clustering at ~8192 bytes.
- Test 2Cron/Loop-Based Fixed-Size Chunk Exfiltration (Linux)
Expected signal: Auditd or Sysmon-for-Linux process execution events for dd and curl repeated 6 times at ~30 second intervals. Firewall/proxy logs (CommonSecurityLog/pan:traffic) showing 6 sessions from the host with SentBytes at ~8192 bytes each.
- Test 3Fixed-Size File Chunk Upload Loop (macOS)
Expected signal: Endpoint Security framework (ES) process-exec events for curl and head repeated 6 times, plus network connection events (es_event_type_notify_open/network extensions or a monitoring proxy) showing 6 sessions with ~8192-byte outbound payloads.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfiltration-UniformSizeBeaconChunking — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.