Techniques › T1030

T1030 Data Transfer Size Limits

exfiltration — Linux, macOS, Windows, ESXi · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0213 Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration v1.0
  AN0596 Windows

  Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  NSM:Flow NetFlow/sFlow/PCAP → DC0078 Network Traffic Flow

  Tunable: PacketSizeThreshold IntervalRepeatWindow KnownServicePorts
  AN0597 Linux

  Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.

  auditd:SYSCALL connect/sendto → DC0082 Network Connection Creation

  NSM:Flow Outbound Network Flow → DC0078 Network Traffic Flow

  Tunable: ProcessNetworkBaseline PayloadLengthVariance RepeatFrequencyThreshold
  AN0598 macOS

  Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.

  macos:unifiedlog com.apple.network → DC0078 Network Traffic Flow

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CONNECT → DC0082 Network Connection Creation

  Tunable: LaunchdJobContext TransferSizeMedian TransferProtocolOutlier

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1030