Data Transfer Size Limits
- ID
- T1030
- Tactics
- TA0010 Exfiltration
- Platforms
- Linux, macOS, Windows, ESXi
- Data sources
- Network Connection Creation, Network Traffic Flow
- Source
- attack.mitre.org
- MITRE last modified
- 17 Sep 2026
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.[1]
Detection
- DET0213 Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration
Data components: Network Connection Creation, Network Traffic Flow
Mitigations (1)
- M1031 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.
Groups (5)
Software (14)
- S0030 Carbanak
- S0150 POSHSPY
- S0154 Cobalt Strike
- S0170 Helminth
- S0264 OopsIE
- S0487 Kessel
- S0495 RDAT
- S0622 AppleSeed
- S0644 ObliqueRAT
- S0699 Mythic
- S1020 Kevin
- S1040 Rclone
- S1141 LunarWeb
- S1200 StealBit