MITRE ATT&CKtechnique
T1030 Data Transfer Size Limits
- Domain
- enterprise
- Tactics
- Exfiltration
- Platforms
- Linux, macOS, Windows, ESXi
- Version
- 1.2
- Created
- 2017-05-31
Description
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
Related
Tactic · MITRE ATT&CK (1)
- TA0010 Exfiltration tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1031 Network Intrusion Prevention mitigation
Referenced by MITRE ATT&CK · uses (21)
- S1200 StealBit software (malware)
- G1040 Play group
- S1141 LunarWeb software (malware)
- C0026 C0026 campaign
- G1014 LuminousMoth group
- C0015 C0015 campaign
- S1040 Rclone software (tool)
- S1020 Kevin software (malware)
- S0699 Mythic software (tool)
- S0644 ObliqueRAT software (malware)
- S0622 AppleSeed software (malware)
- S0495 RDAT software (malware)
- S0487 Kessel software (malware)
- G0096 APT41 group
- S0264 OopsIE software (malware)
- S0170 Helminth software (malware)
- S0150 POSHSPY software (malware)
- S0154 Cobalt Strike software (malware)
- G0007 APT28 group
- G0027 Threat Group-3390 group
- S0030 Carbanak software (malware)
Referenced by Compliance · mitigates (8)
- CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
- NIST-AC-4 Information Flow Enforcement NIST 800-53 control
- NIST-CA-7 Continuous Monitoring NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-SC-7 Boundary Protection NIST 800-53 control
- NIST-SI-3 Malicious Code Protection NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
References
- https://requestly.com/blog/chunked-encoding/ Chunked Encoding