Data Transfer Size Limits
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The technique is defined entirely by quantities no log source in this brief records. Every analytic asks for the same two measurements -- how many bytes a transfer carried, and how evenly spaced repeated transfers were -- and every mutable element is a threshold over an aggregate of those measurements (PacketSizeThreshold, IntervalRepeatWindow, PayloadLengthVariance, RepeatFrequencyThreshold, TransferSizeMedian). Sysmon EventID 3 (network_connection) is a socket-creation record: Image, User, Protocol, Initiated, SourceIp/Port, DestinationIp/Port/Hostname. It carries no byte count, no duration and no direction of volume, so 'uniform packet sizes at a consistent interval' cannot be selected on it at all, and Sysmon EventID 22 (dns_query) is worse -- QueryName, QueryStatus, QueryResults, Image, none of them a size. […]
What the technique is
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0596
Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.
- AN0597
Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.
- AN0598
Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.