Real-world descriptions of how a group, tool or campaign used a technique.
14 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1030 Data Transfer Size Limits |
MalwareAppleSeed | AppleSeed has divided files if the size is 0x1000000 bytes or more. |
| T1030 Data Transfer Size Limits |
MalwareRDAT | RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions. |
| T1030 Data Transfer Size Limits |
MalwareObliqueRAT | ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration. |
| T1030 Data Transfer Size Limits |
MalwarePOSHSPY | POSHSPY uploads data in 2048-byte chunks. |
| T1030 Data Transfer Size Limits |
MalwareCarbanak | Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes . |
| T1030 Data Transfer Size Limits |
MalwareOopsIE | OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks. |
| T1030 Data Transfer Size Limits |
MalwareCobalt Strike | Cobalt Strike will break large data sets into smaller chunks for exfiltration. |
| T1030 Data Transfer Size Limits |
MalwareKessel | Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries. |
| T1030 Data Transfer Size Limits |
MalwareStealBit | StealBit can be configured to exfiltrate files at a specified rate to evade network detection mechanisms. |
| T1030 Data Transfer Size Limits |
MalwareLunarWeb | LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB. |
| T1030 Data Transfer Size Limits |
MalwareKevin | Kevin can exfiltrate data to the C2 server in 27-character chunks. |
| T1030 Data Transfer Size Limits |
MalwareHelminth | Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server. |
| T1030 Data Transfer Size Limits |
ToolRclone | The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits. |
| T1030 Data Transfer Size Limits |
ToolMythic | Mythic supports custom chunk sizes used to upload/download files. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
