tfMITRE ATT&CK technique

Data Transfer Size Limits T1030

Tactic: Exfiltration
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 31 May 2017
Last modified: 24 October 2025

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 22%

Tools & malware78th percentile · 78% of ATT&CK techniques have fewer tools implementing them.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Data Transfer Size Limits T1030

Tactic: Exfiltration
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 31 May 2017
Last modified: 24 October 2025

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 22%

Tools & malware78th percentile · 78% of ATT&CK techniques have fewer tools implementing them.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

Data Transfer Size Limits MITRE reference T1030

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

PlayG1040 ↗

Has split victims' files into chunks for exfiltration.1 2

created 2024-09-242 references

LuminousMothG1014 ↗

Has split archived files into multiple parts to bypass a 5MB limit.1

created 2023-02-231 reference

APT41G0096 ↗

Transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.1

created 2019-09-231 referenceaka Wicked Panda

Threat Group-3390G0027 ↗

Actors have split RAR files for exfiltration into parts.1

created 2017-05-311 referenceaka Earth Smilodon

APT28G0007 ↗

Has split archived exfiltration files into chunks smaller than 1MB.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 5 groups for this technique

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	NetFlow/sFlow/PCAP
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Network Traffic FlowDC0078

NSM:Flow

NetFlow/sFlow/PCAP

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
PacketSizeThreshold	Minimum repetitive size in bytes to consider as anomalous behavior (e.g., 512B or 1024B)
IntervalRepeatWindow	Timeframe over which repeated, evenly spaced transfers are flagged
KnownServicePorts	Common ports expected to exhibit protocol behavior; outliers flagged if not matching expected usage

Field

What you tune

PacketSizeThreshold

Minimum repetitive size in bytes to consider as anomalous behavior (e.g., 512B or 1024B)

IntervalRepeatWindow

Timeframe over which repeated, evenly spaced transfers are flagged

KnownServicePorts

Common ports expected to exhibit protocol behavior; outliers flagged if not matching expected usage

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	Outbound Network Flow
Network Connection CreationDC0082	auditd:SYSCALL	connect/sendto

Field	What you tune
ProcessNetworkBaseline	Whitelist of typical binaries expected to generate outbound connections (e.g., wget, curl)
PayloadLengthVariance	Deviation threshold to consider data 'fixed size' (e.g., ±5% size delta)
RepeatFrequencyThreshold	Number of observed transfers per minute/hour that signals anomalous repetition

Data component	Name	Channel
Network Traffic FlowDC0078	macos:unifiedlog	com.apple.network
Network Connection CreationDC0082	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_CONNECT

Field	What you tune
LaunchdJobContext	Agent context in which transfer occurs (e.g., user/privileged)
TransferSizeMedian	Used to define what constitutes 'fixed size' chunks
TransferProtocolOutlier	Detect if protocol usage deviates from common apps for given destination

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Exfiltration Data Transfer Size Limits	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	4669561d-3bbd-44e3-857c-0e3c6ef2120c
Splunk	The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Exfiltration Data Transfer Size Limits	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	c03d4a49-cf9d-435b-86e9-c6f8c9b6c42e
Splunk	The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts. (...)	Anomaly	stable	process_creation	-	Osquery	Exfiltration Data Transfer Size Limits	-	medium	Raven Tait, Splunk	2026-04-14	2026-09-01	7f1c8bed-9bd4-40b0-a1df-c262cbade0fc
	Detection use of the command "split" to split files into parts and possible transfer.	Generic	test	process_creation	macos	-	Exfiltration Data Transfer Size Limits	-	low	Igor Fits, Mikhail Larin, oscd.community	2020-10-15	2021-11-27	7f2bb9d5-6395-4de5-969c-70c11fbe6b12
	Detection use of the command "split" to split files into parts and possible transfer.	Generic	test	process_creation	linux	Linux Auditd	Exfiltration Data Transfer Size Limits	-	low	Igor Fits, oscd.community	2020-10-15	2022-11-28	2dad0cba-c62a-4a4f-949f-5f6ecd619769

Title

Description

Data Transfer Size Limits T1030

Data Transfer Size Limits T1030

Data Transfer Size Limits MITRE reference T1030

Data Transfer Size Limits MITRE reference T1030

Offense vs defense T1030

Data Transfer Size Limits detection strategy DET0213

Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Data Transfer Size Limits detections T1030

Data Transfer Size Limits detections T1030