T1030 — Data Transfer Size Limits

Tactic: Exfiltration · Platforms: Linux, macOS, Windows, ESXi

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

Sigma detection rules (3)

T1030 Data Transfer Size Limits

title: T1030 Data Transfer Size Limits
id: a69fd400-832f-45a9-b37c-56ed22ba82dd
description: 'Detects candidate outbound network-connection events used to identify chunked/size-limited exfiltration; a single Sysmon NetworkConnect event carries no byte-count field, so chunking must be inferred from connection frequency via the paired correlation rule below. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: PacketSizeThreshold, IntervalRepeatWindow, KnownServicePorts.'
references:
  - https://attack.mitre.org/techniques/T1030
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.exfiltration
  - attack.t1030

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  filter_common_ports:
    DestinationPort:
      - 80
      - 443

  condition: selection and not filter_system_account and not filter_common_ports

falsepositives:
  - System/service accounts and standard web traffic (80/443) are excluded; this base rule surfaces candidate transfer events only — pair with the correlation rule below (many short connections to the same destination in a short window) to actually identify chunking, and tune KnownServicePorts for expected non-web application traffic.

level: low
---
title: T1030 Data Transfer Size Limits - Repeated Small-Connection Correlation
id: fcaa2a58-ab67-45ff-a401-6815eca7d901
status: experimental
description: 'Companion correlation rule for a69fd400-832f-45a9-b37c-56ed22ba82dd — flags a high count of short-lived outbound connections from the same host to the same destination within a short window, a proxy for size-limited/chunked exfiltration that no single NetworkConnect event can show.'
references:
  - https://attack.mitre.org/techniques/T1030
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.exfiltration
  - attack.t1030
correlation:
  type: event_count
  rules:
    - a69fd400-832f-45a9-b37c-56ed22ba82dd
  group-by:
    - Image
    - DestinationIp
  timespan: 10m
  condition:
    gte: 20
level: medium

T1030 Data Transfer Size Limits

title: T1030 Data Transfer Size Limits
id: d12784d0-7ea4-4674-b655-c0ccd766a98b
description: 'T1030 Data Transfer Size Limits: auditd has no native aggregate transfer-size or chunk-count field, so exact "transfer kept below alert threshold" behavior cannot be measured directly from a single event; retargeted to the closest defensible proxy -- explicit use of chunking (split -b) or bandwidth/rate-limiting flags on common transfer utilities (curl --limit-rate, rsync --bwlimit, scp -l), which are the concrete Linux-observable mechanisms an adversary would invoke to deliberately cap transfer size/rate. Tune using: ProcessNetworkBaseline, RepeatFrequencyThreshold (best paired with a companion correlation rule).'
references:
  - https://attack.mitre.org/techniques/T1030
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.exfiltration
  - attack.t1030

logsource:
  category: process_creation
  product: linux

detection:
  selection_split_chunks:
    type: EXECVE
    a0|endswith: '/split'
    a1|contains: '-b'
  selection_curl_rate:
    type: EXECVE
    a0|endswith: '/curl'
    a1|contains: '--limit-rate'
  selection_rsync_rate:
    type: EXECVE
    a0|endswith: '/rsync'
    a1|contains: '--bwlimit'
  selection_scp_rate:
    type: EXECVE
    a0|endswith: '/scp'
    a1|contains: '-l'
  condition: 1 of selection_*

falsepositives:
  - Legitimate bandwidth-conscious backup/sync jobs (rsync --bwlimit, scp -l) run on metered or shared links, and routine use of split for log rotation/archival unrelated to exfiltration.

level: low

T1030 Data Transfer Size Limits

title: T1030 Data Transfer Size Limits
id: ebeb905e-049f-4dcf-9a63-67f638e02627
description: 'Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchdJobContext, TransferSizeMedian, TransferProtocolOutlier.'
references:
  - https://attack.mitre.org/techniques/T1030
author: Shahrukh Khan
date: 2026-05-04
license: MIT
tags:
  - attack.exfiltration
  - attack.t1030

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|contains: '/Library/LaunchAgents/'
  selection_port:
    DestinationPort:
      - 443
      - 8443
  condition: selection and selection_port

falsepositives:
  - Legitimate chunked upload clients that intentionally throttle transfer size, since transfer size median and protocol outlier scoring require aggregation across many events that a single unified log record cannot provide.

level: low

Explore