Skip to content

T1030 Data Transfer Size Limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

Item Value
ID T1030
Sub-techniques
Tactics TA0010
Platforms Linux, Windows, macOS
Version 1.0
Created 31 May 2017
Last Modified 14 July 2020

Procedure Examples

ID Name Description
S0622 AppleSeed AppleSeed has divided files if the size is 0x1000000 bytes or more.5
G0007 APT28 APT28 has split archived exfiltration files into chunks smaller than 1MB.16
C0015 C0015 During C0015, the threat actors limited Rclone‘s bandwidth setting during exfiltration.2
S0030 Carbanak Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .7
S0154 Cobalt Strike Cobalt Strike will break large data sets into smaller chunks for exfiltration.6
S0170 Helminth Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.9
S0487 Kessel Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.14
S1020 Kevin Kevin can exfiltrate data to the C2 server in 27-character chunks.11
G1014 LuminousMoth LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.17
S0699 Mythic Mythic supports custom chunk sizes used to upload/download files.4
S0644 ObliqueRAT ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.10
S0264 OopsIE OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.8
S0150 POSHSPY POSHSPY uploads data in 2048-byte chunks.12
S1040 Rclone The Rclone “chunker” overlay supports splitting large files in smaller chunks during upload to circumvent size limits.32
S0495 RDAT RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.13
G0027 Threat Group-3390 Threat Group-3390 actors have split RAR files for exfiltration into parts.15

Mitigations

ID Mitigation Description
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.

Detection

ID Data Source Data Component
DS0029 Network Traffic Network Connection Creation

References

  1. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. ↩

  2. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩↩

  3. Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022. ↩

  4. Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022. ↩

  5. KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022. ↩

  6. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. ↩

  7. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. ↩

  8. Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018. ↩

  9. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017. ↩

  10. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021. ↩

  11. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. ↩

  12. Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017. ↩

  13. Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020. ↩

  14. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020. ↩

  15. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩

  16. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  17. Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022. ↩