Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1030: Data Transfer Size Limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

EnterpriseT1030TechniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Data Transfer Size Limits matters because exfiltration may not look like one large, obvious upload. An adversary can split data into fixed-size chunks or keep packets below alert thresholds to avoid simple volume-based monitoring. For leaders, the practical question is whether the organization can detect suspicious transfer patterns over time, not just single large transfers.

Executive priority

Prioritize this where sensitive data loss, ransomware double-extortion risk, cloud storage use, or regulated data handling are material. ATT&CK links this technique to multiple groups, campaigns, and tools, including Cobalt Strike, Rclone, StealBit, and several backdoors, so coverage should be assessed as a general exfiltration control problem rather than a niche malware signature issue. Executives should ask whether SOC metrics and audit evidence prove monitoring across Windows, Linux, macOS, and ESXi network paths, including egress points and boundary controls.

Technical view

This is an exfiltration technique for Linux, macOS, Windows, and ESXi where transfer size or packet size is intentionally constrained. MITRE provides no official detection text, but the relationship to DET0213 indicates a detection strategy exists for data transfer size limits and chunked exfiltration. SOC and detection teams should validate whether analytics look for repeated small or fixed-size outbound transfers, unusual consistency in transfer sizes, long-duration low-rate egress, and destination patterns that differ from normal business activity. Relationship context to tools such as Rclone, Cobalt Strike, Mythic, StealBit, and multiple backdoors suggests testing should include both endpoint process context and network egress behavior, without assuming any one tool is present.

Likely telemetry

  • Network flow records showing byte counts, packet counts, duration, source, destination, and timing
  • Proxy, firewall, secure web gateway, or network boundary logs for outbound sessions
  • IDS/IPS alerts and signature hits at network boundaries
  • Endpoint process execution and network connection telemetry, especially for systems initiating outbound transfers
  • DNS and destination reputation/context logs to correlate repeated transfers to unusual external infrastructure

Detection direction

  • Move beyond single-transfer size thresholds; validate analytics that aggregate many small transfers over time by host, user, process, destination, and protocol.
  • Baseline legitimate software update, backup, replication, monitoring, and cloud sync behavior to reduce false positives from normal chunked or rate-limited transfers.
  • Tune for fixed-size or highly regular transfer patterns, especially when paired with unusual destinations, rare processes, or off-hours activity.
  • Correlate network observations with endpoint process lineage where possible, because network-only telemetry may show the pattern but not the responsible tool or user context.
  • Check coverage gaps for Linux, macOS, Windows, and ESXi egress paths, including servers and infrastructure segments that may bypass proxy or endpoint controls.

Mitigation priorities

  • Apply network intrusion prevention or detection signatures at network boundaries, consistent with ATT&CK mitigation M1031.
  • Review egress control strategy so systems only reach required external destinations and services where business justified.
  • Ensure boundary monitoring can aggregate low-and-slow activity over meaningful time windows rather than relying only on large-transfer alerts.
  • Prioritize visibility for sensitive data repositories, servers, and systems that can reach external cloud storage or command-and-control infrastructure.
  • Document monitoring, tuning rationale, and response procedures as compliance evidence for data-loss and incident-response readiness.
Analyst notes and limits

The key decision value is whether the organization can see and investigate exfiltration that is deliberately shaped to avoid volume thresholds. ATT&CK relationships show this behavior is used by several campaigns, groups, and software entries, including ransomware-associated and espionage-associated contexts, but local risk depends on where sensitive data resides and which egress paths are monitored.

MITRE provides no official detection text for T1030 in the supplied object. Telemetry and detection recommendations are defensive interpretations based on the technique description, supported platforms, exfiltration tactic, DET0213 relationship, M1031 relationship, and related software/campaign/group context. Local baselines are required to distinguish malicious chunking from legitimate backup, synchronization, and application traffic.

Official MITRE ATT&CK definition

Data Transfer Size Limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G1040: Play

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.[1][2]

Group Enterprise

G1014: LuminousMoth

LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.[1][2]

Group Enterprise

G0027: Threat Group-3390

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]

Group Enterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Group Enterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

Malware Enterprise

S0150: POSHSPY

POSHSPY is a backdoor that has been used by APT29 since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors. [1]

Windows
Malware Enterprise

S0487: Kessel

Kessel is an advanced version of OpenSSH which acts as a custom backdoor, mainly acting to steal credentials and function as a bot. Kessel has been active since its C2 domain began resolving in August 2018.[1]

Linux
Malware Enterprise

S1020: Kevin

Kevin is a backdoor implant written in C++ that has been used by HEXANE since at least June 2020, including in operations against organizations in Tunisia.[1]

Windows
Malware Enterprise

S1200: StealBit

StealBit is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.[1][2]

Windows
Malware Enterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
Malware Enterprise

S0495: RDAT

RDAT is a backdoor used by the suspected Iranian threat group OilRig. RDAT was originally identified in 2017 and targeted companies in the telecommunications sector.[1]

Windows
Tool Enterprise

S0699: Mythic

Mythic is an open source, cross-platform post-exploitation/command and control platform. Mythic is designed to "plug-n-play" with various agents and communication channels.[1][2][3] Deployed Mythic C2 servers have been observed as part of potentially malicious infrastructure.[4]

WindowsLinuxmacOS
Tool Enterprise

S1040: Rclone

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. Rclone has been used in a number of ransomware campaigns, including those associated with the Conti and DarkSide Ransomware-as-a-Service operations.[1][2][3][4][5]

LinuxWindowsmacOS
Campaign Enterprise

C0015: C0015

C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.[1]

Relationship explorer

All related ATT&CK context

uses · Group G1040: Play Enterprise uses · Group G1014: LuminousMoth Enterprise uses · Group G0027: Threat Group-3390 Enterprise uses · Malware S0264: OopsIE Enterprise uses · Malware S0150: POSHSPY Enterprise uses · Campaign C0026: C0026 Enterprise uses · Malware S0487: Kessel Enterprise uses · Malware S1020: Kevin Enterprise uses · Malware S0644: ObliqueRAT Enterprise uses · Malware S1200: StealBit Enterprise uses · Malware S0622: AppleSeed Enterprise uses · Malware S0154: Cobalt Strike Enterprise mitigates · Mitigation M1031: Network Intrusion Prevention Enterprise uses · Malware S0495: RDAT Enterprise uses · Tool S0699: Mythic Enterprise uses · Tool S1040: Rclone Enterprise uses · Group G0007: APT28 Enterprise uses · Campaign C0015: C0015 Enterprise detects · Detection Strategy DET0213: Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration Enterprise uses · Malware S1141: LunarWeb Enterprise uses · Group G0096: APT41 Enterprise uses · Malware S0030: Carbanak Enterprise uses · Malware S0170: Helminth Enterprise
Mitigations

Mitigation direction

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
7467f364f0d8333e...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle 7467f364f0d8…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  2. [2]
    mitre-attack T1030
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use