{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1030","id":"T1030","name":"Data Transfer Size Limits","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1030","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"bce95de4224f3d364fb7f1342a3a3786588c15bd5c9d81361595301fc5d470df","description":"An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.(Citation: Chunked Encoding)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1030","external_id":"T1030"},{"source_name":"Chunked Encoding","description":"Requestly. (n.d.). Chunked Transfer Encoding Explained. Retrieved September 2, 2026.","url":"https://requestly.com/blog/chunked-encoding/"}],"platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1030","id":"T1030","name":"Data Transfer Size Limits","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1030","technique_page":"techniques/enterprise/T1030/","page":"detections/enterprise/T1030/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"2dad0cba-c62a-4a4f-949f-5f6ecd619769","title":"Split A File Into Pieces - Linux","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/2dad0cba-c62a-4a4f-949f-5f6ecd619769.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml","author":"Igor Fits, oscd.community","kind":"sigma"},{"id":"7f2bb9d5-6395-4de5-969c-70c11fbe6b12","title":"Split A File Into Pieces","status":"test","level":"low","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/7f2bb9d5-6395-4de5-969c-70c11fbe6b12.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml","author":"Igor Fits, Mikhail Larin, oscd.community","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1030-1","technique_id":"T1030","title":"T1030 Data Transfer Size Limits","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#exfiltration","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":182,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L182","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"6c9b97d58407730f24275b005ebc2ae23be0656613a10048ea3be0b1678b4b0d","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(outbound_transfers_with_similar_small_size BY source AND destination, 30m) >= threshold -> ALERT","log_sources":[{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"Proxy and Secure Web Gateway Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#66-proxy-and-secure-web-gateway-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1030-1","technique_id":"T1030","title":"Transfers deliberately limited to evade controls — T1030 Data Transfer Size Limits","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#low-and-slow-exfiltration","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":103,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L103","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"d6f45b37387d177e70ebe5b190399e2abac7a2b076af9e3a1ca12e2d5da5e05c","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"repeated source-destination transfers.","expected_behavior":"transfer sizes and inter-arrival times vary with ordinary usage.","deviation":"persistent repeated small transfers, unusual periodicity, or changed autocorrelation.","anomaly_types":[{"title":"Periodicity Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#27-periodicity-anomaly"},{"title":"Autocorrelation Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#32-autocorrelation-anomaly"},{"title":"Persistent Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#111-persistent-anomaly"}],"log_sources":[{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"},{"title":"Proxy and Secure Web Gateway Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#66-proxy-and-secure-web-gateway-logs"}],"context_references":[{"title":"Truebot joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-187a-truebot.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/230707.pdf"}]}],"anomaly_types":[{"title":"Autocorrelation Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#32-autocorrelation-anomaly"},{"title":"Periodicity Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#27-periodicity-anomaly"},{"title":"Persistent Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#111-persistent-anomaly"}],"strategies":[{"id":"DET0213","name":"Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0213","stix_id":"x-mitre-detection-strategy--d96f78ad-21cd-45dc-940a-63b348894728","relationship_id":"relationship--cc688a88-f152-49d3-a148-806fd9348d44","description":"","analytics":[{"id":"AN0596","name":"Analytic 0596","guidance":"Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.","url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0596","platforms":["Windows"],"tuning":[{"field":"PacketSizeThreshold","description":"Minimum repetitive size in bytes to consider as anomalous behavior (e.g., 512B or 1024B)"},{"field":"IntervalRepeatWindow","description":"Timeframe over which repeated, evenly spaced transfers are flagged"},{"field":"KnownServicePorts","description":"Common ports expected to exhibit protocol behavior; outliers flagged if not matching expected usage"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0596","source_url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0596","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"NetFlow/sFlow/PCAP","platforms":["Windows"],"analytic_id":"AN0596","source_url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0596","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0597","name":"Analytic 0597","guidance":"Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.","url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0597","platforms":["Linux"],"tuning":[{"field":"ProcessNetworkBaseline","description":"Whitelist of typical binaries expected to generate outbound connections (e.g., wget, curl)"},{"field":"PayloadLengthVariance","description":"Deviation threshold to consider data 'fixed size' (e.g., ±5% size delta)"},{"field":"RepeatFrequencyThreshold","description":"Number of observed transfers per minute/hour that signals anomalous repetition"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"connect/sendto","platforms":["Linux"],"analytic_id":"AN0597","source_url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0597","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Outbound Network Flow","platforms":["Linux"],"analytic_id":"AN0597","source_url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0597","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0598","name":"Analytic 0598","guidance":"Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.","url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0598","platforms":["macOS"],"tuning":[{"field":"LaunchdJobContext","description":"Agent context in which transfer occurs (e.g., user/privileged)"},{"field":"TransferSizeMedian","description":"Used to define what constitutes 'fixed size' chunks"},{"field":"TransferProtocolOutlier","description":"Detect if protocol usage deviates from common apps for given destination"}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"macos:unifiedlog","channel":"com.apple.network","platforms":["macOS"],"analytic_id":"AN0598","source_url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0598","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_CONNECT","platforms":["macOS"],"analytic_id":"AN0598","source_url":"https://attack.mitre.org/detectionstrategies/DET0213#AN0598","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1040","name":"Rclone","page":"tools/S1040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0699","name":"Mythic","page":"tools/S0699/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1040","name":"Rclone","page":"tools/S1040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0030","name":"Carbanak","url":"https://attack.mitre.org/software/S0030","kind":"malware","description":"[Carbanak](https://attack.mitre.org/software/S0030) exfiltrates data in compressed chunks if a message is larger than 4096 bytes .(Citation: FireEye CARBANAK June 2017)","relationship_id":"relationship--f4182c2a-c2b3-4866-9f7e-f29e0229dead","references":[{"source_name":"FireEye CARBANAK June 2017","description":"Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}]},{"id":"S0150","name":"POSHSPY","url":"https://attack.mitre.org/software/S0150","kind":"malware","description":"[POSHSPY](https://attack.mitre.org/software/S0150) uploads data in 2048-byte chunks.(Citation: FireEye POSHSPY April 2017)","relationship_id":"relationship--3e497bf1-4fdc-40a2-b8a2-3492c1d605e5","references":[{"source_name":"FireEye POSHSPY April 2017","description":"Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) will break large data sets into smaller chunks for exfiltration.(Citation: cobaltstrike manual)","relationship_id":"relationship--98cc96c2-b876-4e1b-bec9-cb7ea8a8e532","references":[{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"}]},{"id":"S0170","name":"Helminth","url":"https://attack.mitre.org/software/S0170","kind":"malware","description":"[Helminth](https://attack.mitre.org/software/S0170) splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.(Citation: Palo Alto OilRig May 2016)","relationship_id":"relationship--f81274dc-2f5b-47f7-b91f-70a4ebdfde95","references":[{"source_name":"Palo Alto OilRig May 2016","description":"Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}]},{"id":"S0264","name":"OopsIE","url":"https://attack.mitre.org/software/S0264","kind":"malware","description":"[OopsIE](https://attack.mitre.org/software/S0264) exfiltrates command output and collected files to its C2 server in 1500-byte blocks.(Citation: Unit 42 OopsIE! Feb 2018)","relationship_id":"relationship--1abf4f3f-85e7-4bd1-9432-bddd40a0ad75","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","description":"Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}]},{"id":"S0487","name":"Kessel","url":"https://attack.mitre.org/software/S0487","kind":"malware","description":"[Kessel](https://attack.mitre.org/software/S0487) can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--45852cf6-f0e8-45b8-9636-0dee90f7d2fc","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0495","name":"RDAT","url":"https://attack.mitre.org/software/S0495","kind":"malware","description":"[RDAT](https://attack.mitre.org/software/S0495) can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. [RDAT](https://attack.mitre.org/software/S0495) can also download data from the C2 which is split into 81,920-byte portions.(Citation: Unit42 RDAT July 2020)\t","relationship_id":"relationship--a901b584-c676-4419-9357-943de685114e","references":[{"source_name":"Unit42 RDAT July 2020","description":"Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) has divided files if the size is 0x1000000 bytes or more.(Citation: KISA Operation Muzabi)","relationship_id":"relationship--909b065a-d857-48dc-9d6b-f7847bf613e6","references":[{"source_name":"KISA Operation Muzabi","description":"KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"id":"S0644","name":"ObliqueRAT","url":"https://attack.mitre.org/software/S0644","kind":"malware","description":"[ObliqueRAT](https://attack.mitre.org/software/S0644) can break large files of interest into smaller chunks to prepare them for exfiltration.(Citation: Talos Oblique RAT March 2021)","relationship_id":"relationship--6aae6da8-eaf5-4139-a773-25075c4e0cc6","references":[{"source_name":"Talos Oblique RAT March 2021","description":"Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}]},{"id":"S0699","name":"Mythic","url":"https://attack.mitre.org/software/S0699","kind":"tool","description":"[Mythic](https://attack.mitre.org/software/S0699) supports custom chunk sizes used to upload/download files.(Citation: Mythc Documentation)\t","relationship_id":"relationship--ac603ee0-cb62-4ad5-852a-29b70b225c5f","references":[{"source_name":"Mythc Documentation","description":"Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022.","url":"https://docs.mythic-c2.net/"}]},{"id":"S1020","name":"Kevin","url":"https://attack.mitre.org/software/S1020","kind":"malware","description":"[Kevin](https://attack.mitre.org/software/S1020) can exfiltrate data to the C2 server in 27-character chunks.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--681857ae-6461-4070-a2b8-1fb53972ab38","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1040","name":"Rclone","url":"https://attack.mitre.org/software/S1040","kind":"tool","description":"The [Rclone](https://attack.mitre.org/software/S1040) \"chunker\" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.(Citation: Rclone)(Citation: DFIR Conti Bazar Nov 2021)","relationship_id":"relationship--b351cd80-323d-4e67-a539-547a76d9e257","references":[{"source_name":"DFIR Conti Bazar Nov 2021","description":"DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"},{"source_name":"Rclone","description":"Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.","url":"https://rclone.org"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--d91ceccf-8a53-4a99-a71d-b471f58eaf05","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can be configured to exfiltrate files at a specified rate to evade network detection mechanisms.(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--727a1214-1098-4639-8482-5d6d8718de76","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has split archived exfiltration files into chunks smaller than 1MB.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)","relationship_id":"relationship--b4c27a33-0669-4b10-a801-eb81e3563260","references":[{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","description":"NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) actors have split RAR files for exfiltration into parts.(Citation: Dell TG-3390)","relationship_id":"relationship--0b36c1d0-d016-4c12-bf61-6dc14b29c7e0","references":[{"source_name":"Dell TG-3390","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.(Citation: Rostovcev APT41 2021)","relationship_id":"relationship--f291084b-a84d-452f-bd1d-d89257c7e8c2","references":[{"source_name":"Rostovcev APT41 2021","description":"Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"id":"G1014","name":"LuminousMoth","url":"https://attack.mitre.org/groups/G1014","kind":"intrusion-set","description":"[LuminousMoth](https://attack.mitre.org/groups/G1014) has split archived files into multiple parts to bypass a 5MB limit.(Citation: Bitdefender LuminousMoth July 2021)","relationship_id":"relationship--07a569f4-ecb0-45b2-a880-3542508e9835","references":[{"source_name":"Bitdefender LuminousMoth July 2021","description":"Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"[Play](https://attack.mitre.org/groups/G1040) has split victims' files into chunks for exfiltration.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--017d597b-2268-4760-baf0-0cee23906965","references":[{"source_name":"CISA Play Ransomware Advisory December 2023","description":"CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]}],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.","relationship_id":"relationship--a0a004fe-2636-4f6d-85c7-2401768252a2","references":[]}],"candidates":[{"id":"ab936c51-10f4-46ce-9144-e02137b2016a","name":"Data Transfer Size Limits","platforms":["macos","linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1030/T1030.yaml","description":"Take a file/directory, split it into 5Mb chunks\n","inputs":{"file_name":{"description":"File name","type":"path","default":"T1030_urandom"},"folder_path":{"description":"Path where the test creates artifacts","type":"path","default":"/tmp/T1030"}},"dependencies":[{"description":"The file must exist for the test to run."}],"source_definition_sha256":"f9f1b1b48fecc4336a58bd79e70063c63312d254aec403e351d4025ebc728e2b"},{"id":"f0287b58-f4bc-40f6-87eb-692e126e7f8f","name":"Network-Based Data Transfer in Small Chunks","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1030/T1030.yaml","description":"Simulate transferring data over a network in small chunks to evade detection.","inputs":{"source_file_path":{"description":"Path to the source file to transfer.","type":"path","default":"[User specified]"},"destination_url":{"description":"URL of the destination server.","type":"url","default":"http://example.com"},"chunk_size":{"description":"Size of each data chunk (in KB).","type":"integer","default":1024}},"dependencies":[],"source_definition_sha256":"76e4e35e44cbd4288adfbacc36b78cd30405cfed7e486939fca73b83179db499"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1030":"/ttp-simulation/techniques/enterprise/T1030/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1030","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}