Thanks to all of our ATT&CKcon participants. All sessions are here, and individual presentations will be posted soon.

Data Transfer Size Limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

ID: T1030

Tactic: Exfiltration

Platform:  Linux, macOS, Windows

Data Sources:  Packet capture, Netflow/Enclave netflow, Process use of network, Process monitoring

Requires Network:  Yes

Version: 1.0

Examples

NameDescription
Carbanak

Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .[1]

Helminth

Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.[2]

OopsIE

OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.[3]

POSHSPY

POSHSPY uploads data in 2048-byte chunks.[4]

Threat Group-3390

Threat Group-3390 actors have split RAR files for exfiltration into parts.[5]

Mitigation

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools. [6]

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). If a process maintains a long connection during which it consistently sends fixed size data packets or a process opens connections and sends fixed sized data packets at regular intervals, it may be performing an aggregate data transfer. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. [6]

References