T1030 Data Transfer Size Limits
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. MITRE ATT&CK
1 program on CmdID 1 Sigma rule T1030 on attack.mitre.org
Programs for it
Sigma rules tagged with it
Command lines CmdID reads as it
Split a file, each split having 10 lines (except the last split) on the page for split
split --lines 10 path/to/fileIdentifySplit a file into 5 files. File is split such that each split has same size (except the last split) on the page for split
split --number 5 path/to/fileIdentifySplit a file with 512 bytes in each split (except the last split; use 512k for kilobytes and 512m for megabytes) on the page for split
split --bytes 512 path/to/fileIdentifyAn example is here when CmdID’s reading of it names T1030: a Sigma rule it trips is tagged with it, or its abuse is documented as it.