{"id":"T1030","name":"Data Transfer Size Limits","url":"https://attack.mitre.org/techniques/T1030","tactics":["exfiltration"],"platforms":["Linux","macOS","Windows","ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0213","stix_id":"x-mitre-detection-strategy--d96f78ad-21cd-45dc-940a-63b348894728","name":"Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0213","analytics":[{"id":"AN0596","stix_id":"x-mitre-analytic--1e9fdc71-d073-403a-9ee9-bab091318454","name":"Analytic 0596","description":"Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.","url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0596","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"NetFlow/sFlow/PCAP","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"PacketSizeThreshold","description":"Minimum repetitive size in bytes to consider as anomalous behavior (e.g., 512B or 1024B)"},{"field":"IntervalRepeatWindow","description":"Timeframe over which repeated, evenly spaced transfers are flagged"},{"field":"KnownServicePorts","description":"Common ports expected to exhibit protocol behavior; outliers flagged if not matching expected usage"}],"live":true,"detection_strategies":["DET0213"],"techniques":["T1030"]},{"id":"AN0597","stix_id":"x-mitre-analytic--4baad14d-46b1-4e96-9e2a-138ae4e3ec75","name":"Analytic 0597","description":"Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.","url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0597","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"connect/sendto","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"Outbound Network Flow","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ProcessNetworkBaseline","description":"Whitelist of typical binaries expected to generate outbound connections (e.g., wget, curl)"},{"field":"PayloadLengthVariance","description":"Deviation threshold to consider data 'fixed size' (e.g., ±5% size delta)"},{"field":"RepeatFrequencyThreshold","description":"Number of observed transfers per minute/hour that signals anomalous repetition"}],"live":true,"detection_strategies":["DET0213"],"techniques":["T1030"]},{"id":"AN0598","stix_id":"x-mitre-analytic--d0edef63-9a98-4435-9f4b-2c577c7de41d","name":"Analytic 0598","description":"Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.","url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0598","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"com.apple.network","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_CONNECT","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-endpointsecurity"}],"mutable_elements":[{"field":"LaunchdJobContext","description":"Agent context in which transfer occurs (e.g., user/privileged)"},{"field":"TransferSizeMedian","description":"Used to define what constitutes 'fixed size' chunks"},{"field":"TransferProtocolOutlier","description":"Detect if protocol usage deviates from common apps for given destination"}],"live":true,"detection_strategies":["DET0213"],"techniques":["T1030"]}],"live":true,"version":"1.0","techniques":["T1030"]}],"sigma_rules":[{"id":"2dad0cba-c62a-4a4f-949f-5f6ecd619769","title":"Split A File Into Pieces - Linux","author":"Igor Fits, oscd.community","status":"test","level":"low","date":"2020-10-15","modified":"2022-11-28","description":"Detection use of the command \"split\" to split files into parts and possible transfer.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.exfiltration","attack.t1030"],"path":"rules/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml","techniques":["T1030"],"cves":[]},{"id":"7f2bb9d5-6395-4de5-969c-70c11fbe6b12","title":"Split A File Into Pieces","author":"Igor Fits, Mikhail Larin, oscd.community","status":"test","level":"low","date":"2020-10-15","modified":"2021-11-27","description":"Detection use of the command \"split\" to split files into parts and possible transfer.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.exfiltration","attack.t1030"],"path":"rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml","techniques":["T1030"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}