DET0028 Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes
| Item |
Value |
| ID |
DET0028 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1496.002 (Bandwidth Hijacking)
Analytics
Windows
AN0080
Processes invoking network-intensive child processes or uploading large data volumes, often from non-standard user or system contexts, with evidence of long-duration TCP/UDP sessions to unusual destinations.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
Bandwidth anomalies should be assessed over 5-15 min or hourly windows depending on environment size. |
| DestinationCountry |
Some organizations whitelist traffic to countries based on geolocation. |
| ProcessName |
Legitimate processes using high bandwidth (e.g., backup tools) must be excluded. |
Linux
AN0081
User-initiated processes generating sustained outbound traffic over common or non-standard ports, often outside business hours, potentially linked to scanning or proxyjacking. Includes curl, wget, masscan, or proxy clients.
Log Sources
Mutable Elements
| Field |
Description |
| ToolPattern |
Can be tuned for specific bandwidth abuse tools (e.g., proxychains, 3proxy). |
| TrafficRateThreshold |
Baseline deviation thresholds must be environment-specific. |
macOS
AN0082
Suspicious long-lived or high-throughput connections by non-Apple signed apps or processes not commonly associated with network uploads. Detect background processes using open sockets for data egress.
Log Sources
Mutable Elements
| Field |
Description |
| ProcessSignedStatus |
Non-signed or non-Apple signed binaries can raise confidence levels. |
| DataRateThreshold |
Observed data rate per process over time (e.g., MB/s). |
Containers
AN0083
Containerized apps or sidecar containers generating excessive outbound traffic or being leveraged for proxy networks. Includes sudden increases in network interface stats, especially in dormant or low-util apps.
Log Sources
Mutable Elements
| Field |
Description |
| ContainerBaselineNetworkUsage |
Baseline per container must be defined by app purpose and normal traffic. |
| ImageName |
Certain image names or registries may be prone to abuse (e.g., public image hosting mining or proxyware). |
IaaS
AN0084
Virtual instances or workloads generating sustained outbound data rates, often to TOR, VPN, or proxy endpoints. Often coincides with unusual IAM usage or deployed scripts (e.g., cron jobs using proxy clients).
Log Sources
Mutable Elements
| Field |
Description |
| InstanceType |
High-throughput instance types are more likely to be targeted for hijacking. |
| TrafficEgressThreshold |
Customize detection thresholds based on cloud provider quotas or billing alerts. |