AN0596
Analytic 0596
Windows
Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
NetFlow/sFlow/PCAP
[PacketSizeThreshold]
Minimum repetitive size in bytes to consider as anomalous behavior (e.g., 512B or 1024B)
[IntervalRepeatWindow]
Timeframe over which repeated, evenly spaced transfers are flagged
[KnownServicePorts]
Common ports expected to exhibit protocol behavior; outliers flagged if not matching expected usage
AN0597
Analytic 0597
Linux
Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.
auditd:SYSCALL
connect/sendto
NSM:Flow
Outbound Network Flow
[ProcessNetworkBaseline]
Whitelist of typical binaries expected to generate outbound connections (e.g., wget, curl)
[PayloadLengthVariance]
Deviation threshold to consider data 'fixed size' (e.g., ±5% size delta)
[RepeatFrequencyThreshold]
Number of observed transfers per minute/hour that signals anomalous repetition
AN0598
Analytic 0598
macOS
Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.
macos:unifiedlog
com.apple.network
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_CONNECT
[LaunchdJobContext]
Agent context in which transfer occurs (e.g., user/privileged)
[TransferSizeMedian]
Used to define what constitutes 'fixed size' chunks
[TransferProtocolOutlier]
Detect if protocol usage deviates from common apps for given destination