{ "technique_id": "T1030", "name": "Data Transfer Size Limits", "priority": "high", "status": "draft", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Exfiltration" ], "platforms": [ "Linux", "macOS", "Windows", "ESXi" ], "summary": "An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.", "soc_recommendation": "Investigate Data Transfer Size Limits activity in the context of Exfiltration: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.", "d3fend_mappings": [ { "id": "D3-UGLPA", "name": "User Geolocation Logon Pattern Analysis", "relationship": "detect", "practical_action": "Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-NTF", "name": "Network Traffic Filtering", "relationship": "isolate", "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.", "tooling": [ "Sentinel", "Defender for Endpoint" ] } ], "investigation_steps": { "microsoft": [ "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.", "Check Sentinel analytics rules and incidents correlated with this technique.", "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource." ], "generic": [ "Confirm whether the observed data transfer size limits activity matches expected administrative or application behaviour.", "Identify the host, account, or resource where the activity occurred and its business criticality.", "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.", "Real detection reference: \"Mimecast Data Leak Prevention - Notifications\" -- Detects threat for data leak when action is notification" ] }, "evidence_to_collect": [ "Host or resource affected", "Account or identity involved", "Timestamp of the activity", "Related process, file, or network artifact", "Any preceding or follow-on alerts" ], "response_actions": [ { "name": "Contain the affected host or account", "category": "Containment", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "Defender for Endpoint / Entra ID", "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account." }, { "name": "Collect and preserve evidence", "category": "Investigation", "risk": "Low", "automation_safe": true, "approval_required": false, "tool": "Defender for Endpoint", "notes": "Safe -- read-only evidence collection." } ], "queries": { "kql": [ { "name": "cfd67598-ad0d-430a-a793-027eb4dbe967 — Mimecast Data Leak Prevention - Notifications", "description": "Detects threat for data leak when action is notification (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "MimecastDLP \n| where Action == \"notification\"\n| extend SenderAddress = ['Sender Address'] ,RecipientAddress = ['Recipient Address']" }, { "name": "1818aeaa-4cc8-426b-ba54-539de896d299 — Mimecast Data Leak Prevention - Notifications", "description": "Detects threat for data leak when action is notification (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "MimecastDLP_CL| where action_s == \"notification\";" }, { "name": "06a9b845-6a95-4432-a78b-83919b28c375 — Time series anomaly detection for total volume of traffic", "description": "Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical patterns. The query leverages a KQL built-in anomaly detection algorithm to find large deviations from baseline patterns. Sudden increases in network traffic volume may be an indication of data exfiltration attempts and should be investigated. The higher the score, the further it is from the baseline value. The output is aggregated to provide summary view of unique source IP to destination IP address and port traffic observed in the flagged anomaly hour. The source IP addresses which were sending less than percentotalthreshold of the total traffic have been exluded whose value can be adjusted as needed . You may have to run queries for individual source IP addresses from SourceIPlist to determine if anything looks suspicious' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "let starttime = 14d;\nlet endtime = 1d;\nlet timeframe = 1h;\nlet scorethreshold = 5;\nlet percentotalthreshold = 50;\nlet TimeSeriesData = CommonSecurityLog\n| where isnotempty(DestinationIP) and isnotempty(SourceIP)\n| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))\n| project TimeGenerated,SourceIP, DestinationIP, DeviceVendor\n| make-series Total=count() on TimeGenerated from startofday(ago(starttime)) to startofday(ago(endtime)) step timeframe by DeviceVendor;\n// Filtering specific records associated with spikes as outliers\nlet TimeSeriesAlerts=materialize(TimeSeriesData\n| extend (anomalies, score, baseline) = series_decompose_anomalies(Total, scorethreshold, -1, 'linefit')\n| mv-expand Total to typeof(double), TimeGenerated to typeof(datetime), anomalies to typeof(double),score to typeof(double), baseline to typeof(long)\n| where anomalies > 0 | extend score = round(score,2), AnomalyHour = TimeGenerated\n| project DeviceVendor,AnomalyHour, TimeGenerated, Total, baseline, anomalies, score);\nlet AnomalyHours = materialize(TimeSeriesAlerts | where TimeGenerated > ago(2d) | project TimeGenerated);\n// Join anomalies with Base Data to popalate associated records for investigation - Results sorted by score in descending order\nTimeSeriesAlerts\n| where TimeGenerated > ago(2d)\n| join (\n CommonSecurityLog\n| where isnotempty(DestinationIP) and isnotempty(SourceIP)\n| where TimeGenerated > ago(2d)\n| extend DateHour = bin(TimeGenerated, 1h) // create a new column and round to hour\n| where DateHour in ((AnomalyHours)) //filter the dataset to only selected anomaly hours\n| summarize HourlyCount = count(), TimeGeneratedMax = arg_max(TimeGenerated, *), DestinationIPlist = make_set(DestinationIP, 100), DestinationPortlist = make_set(DestinationPort, 100) by DeviceVendor, SourceIP, TimeGeneratedHour= bin(TimeGenerated, 1h)\n| extend AnomalyHour = TimeGeneratedHour\n) on AnomalyHour, DeviceVendor\n| extend PercentTotal = round((HourlyCount / Total) * 100, 3)\n| where PercentTotal > percentotalthreshold\n| project DeviceVendor , AnomalyHour, TimeGeneratedMax, SourceIP, DestinationIPlist, DestinationPortlist, HourlyCount, PercentTotal, Total, baseline, score, anomalies\n| summarize HourlyCount=sum(HourlyCount), StartTimeUtc=min(TimeGeneratedMax), EndTimeUtc=max(TimeGeneratedMax), SourceIPlist = make_set(SourceIP, 100), SourceIPMax= arg_max(SourceIP, *), DestinationIPlist = make_set(DestinationIPlist, 100), DestinationPortlist = make_set(DestinationPortlist, 100) by DeviceVendor , AnomalyHour, Total, baseline, score, anomalies\n| project DeviceVendor , AnomalyHour, EndTimeUtc, SourceIPMax ,SourceIPlist, DestinationIPlist, DestinationPortlist, HourlyCount, Total, baseline, score, anomalies" } ], "spl": [], "esql": [ { "name": "c3d4e5f6-a7b8-9012-cdef-123456789abc — GenAI Process Performing Encoding/Chunking Prior to Network Activity", "description": "(EQL) Detects when GenAI processes perform encoding or chunking (base64, gzip, tar, zip) followed by outbound network activity. This sequence indicates data preparation for exfiltration. Attackers encode or compress sensitive data before transmission to obfuscate contents and evade detection. Legitimate GenAI workflows rarely encode data before network communications. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "sequence by process.entity_id with maxspan=30s\n\n // Encoding/compression followed by network activity\n [process where event.type == \"start\"\n and event.type == \"start\"\n\n // Encoding/chunking tools\n and (\n // Native encoding tools\n process.name in (\"base64\", \"gzip\", \"tar\", \"zip\", \"split\", \"7z\", \"7za\", \"7zr\") or\n \n // PowerShell encoding\n (process.name in (\"powershell.exe\", \"pwsh.exe\") and\n process.command_line like~ (\"*Compress-Archive*\", \"*[Convert]::ToBase64String*\")) or\n \n // Python encoding\n (process.name like~ \"python*\" and\n process.command_line like~ (\"*base64*\", \"*gzip*\", \"*zlib*\", \"*tarfile*\", \"*zipfile*\")) or\n \n // Node.js encoding\n (process.name in (\"node.exe\", \"node\") and\n process.command_line like~ (\"*Buffer.from*\", \"*zlib*\", \"*gzip*\") and\n not process.command_line like~ (\"*mcp*start*\", \"*mcp-server*\", \"*npm exec*mcp*\"))\n )\n\n // GenAI parent process\n and (\n process.parent.name in (\n \"ollama.exe\", \"ollama\", \"Ollama\",\n \"textgen.exe\", \"textgen\", \"text-generation-webui.exe\", \"oobabooga.exe\",\n \"lmstudio.exe\", \"lmstudio\", \"LM Studio\",\n \"claude.exe\", \"claude\", \"Claude\",\n \"cursor.exe\", \"cursor\", \"Cursor\", \"Cursor Helper\", \"Cursor Helper (Plugin)\",\n \"copilot.exe\", \"copilot\", \"Copilot\",\n \"codex.exe\", \"codex\",\n \"Jan\", \"jan.exe\", \"jan\", \"Jan Helper\",\n \"gpt4all.exe\", \"gpt4all\", \"GPT4All\",\n \"gemini-cli.exe\", \"gemini-cli\",\n \"genaiscript.exe\", \"genaiscript\",\n \"grok.exe\", \"grok\",\n \"qwen.exe\", \"qwen\",\n \"koboldcpp.exe\", \"koboldcpp\", \"KoboldCpp\",\n \"llama-server\", \"llama-cli\"\n ) or\n \n // Node/Deno with GenAI frameworks\n (process.parent.name in (\"node.exe\", \"node\", \"deno.exe\", \"deno\") and\n process.parent.command_line like~ (\n \"*ollama*\", \"*mcp-server*\", \"*@modelcontextprotocol*\", \"*langchain*\", \"*autogpt*\",\n \"*babyagi*\", \"*agentgpt*\", \"*crewai*\", \"*semantic-kernel*\", \"*llama-index*\",\n \"*haystack*\", \"*openai*\", \"*anthropic*\", \"*cohere*\", \"*mistral*\"\n )) or\n \n // Python with GenAI frameworks\n (process.parent.name like~ \"python*\" and\n process.parent.command_line like~ (\n \"*ollama*\", \"*mcp-server*\", \"*langchain*\", \"*autogpt*\", \"*babyagi*\",\n \"*agentgpt*\", \"*crewai*\", \"*semantic-kernel*\", \"*llama-index*\", \"*haystack*\",\n \"*openai*\", \"*anthropic*\", \"*cohere*\", \"*mistral*\"\n ))\n )\n ] by process.entity_id\n\n // Outbound network connection (non-local)\n [network where event.type == \"start\"\n and event.action == \"connection_attempted\"\n and destination.ip != null\n and not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.0.0/29\",\n \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\", \"192.0.2.0/24\",\n \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\",\n \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\", \"FE80::/10\",\n \"FF00::/8\")\n \n ] by process.entity_id" }, { "name": "e302e6c3-448c-4243-8d9b-d41da70db582 — Potential Data Splitting Detected", "description": "(EQL) This rule looks for the usage of common data splitting utilities with specific arguments that indicate data splitting for exfiltration on Linux systems. Data splitting is a technique used by adversaries to split data into smaller parts to avoid detection and exfiltrate data. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\n event.action in (\"exec\", \"exec_event\", \"start\", \"ProcessRollup2\") and\n (\n (process.name == \"dd\" and process.args like \"bs=*\" and process.args like \"if=*\") or\n (\n process.name in (\"split\", \"rsplit\") and\n (\n (process.args == \"-b\" or process.args like \"--bytes*\") or\n (process.args == \"-C\" or process.args like \"--line-bytes*\")\n )\n )\n ) and\n not (\n process.parent.name in (\"apport\", \"overlayroot\", \"nessus-agent-module\") or\n process.args like (\n \"if=/tmp/nvim*\", \"if=/boot/*\", \"if=/dev/random\", \"if=/dev/urandom\", \"/dev/mapper/*\",\n \"if=*.iso\", \"of=/dev/stdout\", \"if=/dev/zero\", \"if=/dev/sda\", \"/proc/sys/kernel/*\"\n ) or\n ?process.parent.args in (\"/etc/init.d/apport\", \"/usr/bin/spectre-meltdown-checker\")\n )" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Run enrichment queries.", "Create ServiceNow SecOps task." ], "approval_required": [ "Contain or disable the affected host/account.", "Any change to production configuration." ] }, "escalation_criteria": [ "Data Transfer Size Limits activity observed on a privileged account or critical system.", "Activity follows or precedes other suspicious behaviour in the same investigation.", "Automated triage cannot confidently rule out malicious intent." ], "false_positive_considerations": [ "Legitimate administrative or maintenance activity matching this pattern.", "Approved security testing or red team exercise.", "Known benign software producing similar telemetry." ], "confluence": { "title": "T1030 - Data Transfer Size Limits Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }