Many network alerts fire when a host sends more than some amount of data. An adversary who knows that can cut the data into pieces that each stay under the line.
MITRE tracks this as Data Transfer Size Limits, technique T1030, in the Exfiltration tactic. It applies to ESXi, Linux, macOS and Windows.
How attackers use it
MITRE says an adversary may exfiltrate data in fixed size chunks instead of whole files, or limit packet sizes below certain thresholds. The purpose is to avoid network data transfer threshold alerts.
The total leaves the network anyway. Only the shape of the traffic changes.
How to detect it
MITRE's strategy (DET0213) looks at shape and timing:
- A process makes outbound connections that send uniform packet sizes at a consistent interval, avoiding threshold based alerts.
- Outbound connections from processes that are not network facing repeatedly send similar sized payloads at uniform intervals.
- On macOS, processes start external connections that send data in fixed sizes using LaunchAgents or unexpected users.
So a single large transfer rule is not enough. Add:
- Cumulative volume per host and destination over hours and days, not only per connection.
- Uniformity checks: many transfers with almost identical size and spacing look machine made.
- Process context: which program is sending, and does it normally use the network?
How to reduce the risk
MITRE lists one mitigation: network intrusion prevention. Network signatures can identify traffic for specific command and control infrastructure and malware. Pair it with egress filtering so that servers can reach only the destinations they need.
Quick check
Why do per connection thresholds miss chunked exfiltration?
Each chunk is small enough to stay under the threshold. Only cumulative volume and the uniform size and timing pattern show the theft.
Sources
- MITRE ATT&CK, Data Transfer Size Limits (T1030)
