Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Flow (DC0078) | NSM:Flow | NetFlow/sFlow/PCAP |
| Field | Description |
|---|---|
| PacketSizeThreshold | Minimum repetitive size in bytes to consider as anomalous behavior (e.g., 512B or 1024B) |
| IntervalRepeatWindow | Timeframe over which repeated, evenly spaced transfers are flagged |
| KnownServicePorts | Common ports expected to exhibit protocol behavior; outliers flagged if not matching expected usage |
Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | connect/sendto |
| Network Traffic Flow (DC0078) | NSM:Flow | Outbound Network Flow |
| Field | Description |
|---|---|
| ProcessNetworkBaseline | Whitelist of typical binaries expected to generate outbound connections (e.g., wget, curl) |
| PayloadLengthVariance | Deviation threshold to consider data 'fixed size' (e.g., ±5% size delta) |
| RepeatFrequencyThreshold | Number of observed transfers per minute/hour that signals anomalous repetition |
Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | macos:unifiedlog | com.apple.network |
| Network Connection Creation (DC0082) | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_CONNECT |
| Field | Description |
|---|---|
| LaunchdJobContext | Agent context in which transfer occurs (e.g., user/privileged) |
| TransferSizeMedian | Used to define what constitutes 'fixed size' chunks |
| TransferProtocolOutlier | Detect if protocol usage deviates from common apps for given destination |