Cross-source coverage
T1030 / ATT&CK
Data Transfer Size Limits
From MITRE ATT&CK 19.2
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
- Tactics
- Exfiltration
- Platforms
- Linux · macOS · Windows · ESXi
- Telemetry
-
WinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:unifiedlogmacos:endpointsecurity
How MITRE says to detect it DET0213
Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration
Windows Analytic 0596
Adversary uses a process to establish outbound connections that transmit uniform packet sizes at a consistent interval, avoiding threshold-based network alerts.
WinEventLog:SysmonEventCode=3, 22NSM:FlowNetFlow/sFlow/PCAP
Linux Analytic 0597
Outbound connections from non-network-facing processes repeatedly send similarly sized payloads within uniform time intervals.
auditd:SYSCALLconnect/sendtoNSM:FlowOutbound Network Flow
macOS Analytic 0598
Processes on macOS initiate external connections that consistently transmit data in fixed sizes using LaunchAgents or unexpected users.
macos:unifiedlogcom.apple.networkmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_CONNECT
Azure/Azure-Sentinel
5 rules| Detection | Severity | Format |
|---|---|---|
| Time series anomaly detection for total volume of traffic | Medium | KQL |
| Time series anomaly for data size transferred to public internet | Medium | KQL |
| Multiple large queries made by user | Undefined | KQL |
| Query data volume anomolies | Undefined | KQL |
| User returning more data than daily average | Undefined | KQL |
socfortress/Wazuh-Rules
4 rules · 3 families| Detection | Severity | Format |
|---|---|---|
| Detection use of the command "split" to split files into parts and possible transfer. 2 variants | High | Wazuh XML |
| Potential data staging or splitting operation detected using 'split'. | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Chunked Upload (T1030) | High | Wazuh XML |
| Detection use of the command "split" to split files into parts and possible transfer. 2 variants | Medium | Wazuh XML |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Linux Auditd Data Transfer Size Limits Via Split | Undefined | SPL |
| Linux Auditd Data Transfer Size Limits Via Split Syscall | Undefined | SPL |
| MacOS Data Chunking | Undefined | SPL |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Split A File Into Pieces | Low | Sigma |
| Split A File Into Pieces - Linux | Low | Sigma |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| GenAI Process Performing Encoding/Chunking Prior to Network Activity | Medium | Elastic TOML |
| Potential Data Splitting Detected | Medium | Elastic TOML |