ATT&CK T1123 - Possible Audio Stream Exfiltration (RTP)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential audio stream exfiltration using the Real-time Transport Protocol (RTP). It specifically looks for UDP traffic with a packet size between 160 and 200 bytes, which is characteristic of some RTP audio streams. A threshold of 100 such packets from the same source within 10 seconds triggers the alert, indicating a sustained audio stream.