T1030
Data Transfer Size Limits
Linux · macOS · Windows · ESXinothing on this site yetT1030 on attack.mitre.org
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration
- Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.
- Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.
- Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.