atomic-red-team/atomics/T1030/T1030.md

T1030 - Data Transfer Size Limits

Description from ATT&CK

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

Atomic Tests

• Atomic Test #1 - Data Transfer Size Limits

Atomic Test #1 - Data Transfer Size Limits

Take a file/directory, split it into 5Mb chunks

Supported Platforms: macOS, CentOS, Ubuntu, Linux

Run it with sh!

cd /tmp/
dd if=/dev/urandom of=/tmp/victim-whole-file bs=25M count=1
split -b 5000000 /tmp/victim-whole-file
ls -l