Use intrusion detection signatures to block traffic at network boundaries.
MITRE mitigation sourceAdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Data Transfer Size Limits
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). If a process maintains a long connection during which it consistently sends fixed size data packets or a process opens connections and sends fixed sized data packets at regular intervals, it may be performing an aggregate data transfer. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Evidence integrity, order of volatility, and chain of custody
Digital Forensics & Incident Response (DFIR) · Governed topic match · 54/100Architecture, assets, trust boundaries, and AI threat modeling
AI Security · Governed topic match · 51/100Agents, tools, plugins, browsers, and MCP security
AI Security · Governed topic match · 51/100Infrastructure, network, resource, and availability security
AI Security · Governed topic match · 51/100AI red teaming, evaluation, and reproducible security testing
AI Security · Governed topic match · 51/100Governance, risk, assurance, transparency, and human factors
AI Security · Governed topic match · 51/100Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Module 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · Tactic learning route · 24/100Infrastructure as code, CI/CD, artifact provenance, and policy as code
Cloud Security · Tactic learning route · 24/100
Digital Forensics & Incident Response (DFIR) · Governed topic match · 54/100Architecture, assets, trust boundaries, and AI threat modeling
AI Security · Governed topic match · 51/100Agents, tools, plugins, browsers, and MCP security
AI Security · Governed topic match · 51/100Infrastructure, network, resource, and availability security
AI Security · Governed topic match · 51/100AI red teaming, evaluation, and reproducible security testing
AI Security · Governed topic match · 51/100Governance, risk, assurance, transparency, and human factors
AI Security · Governed topic match · 51/100Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Module 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · Tactic learning route · 24/100Infrastructure as code, CI/CD, artifact provenance, and policy as code
Cloud Security · Tactic learning route · 24/100
MITRE mitigations
MITRE detection strategies and analytics
- AN0596 · Analytic 0596 — Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.
- AN0597 · Analytic 0597 — Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.
- AN0598 · Analytic 0598 — Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.