Data Transfer Size Limits

// T1030 — Data Transfer Size Limits
// Part 1: Process creation — compression/transfer tools with volume/chunk-size flags
let SplittingTools = dynamic(["7z.exe","7za.exe","7zr.exe","rar.exe","winrar.exe","rclone.exe","split"]);
let VolumeFlagPatterns = dynamic([
  " -v", "/v", "-volume", "--max-size", "--chunk-size",
  "chunker", "split -b", "split -n", "--bytes",
  "-v10m","-v50m","-v100m","-v500m","-v1g","-v1024"
]);
let ChunkResults =
  DeviceProcessEvents
  | where Timestamp > ago(24h)
  | where FileName in~ (SplittingTools)
      or (FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh") and ProcessCommandLine has_any (VolumeFlagPatterns))
  | where ProcessCommandLine has_any (VolumeFlagPatterns)
  | extend SignalType = case(
      FileName =~ "rclone.exe" and ProcessCommandLine has "chunker", "RcloneChunker",
      FileName =~ "rclone.exe" and ProcessCommandLine has "--max-size", "RcloneMaxSize",
      FileName in~ ("7z.exe","7za.exe","7zr.exe") and ProcessCommandLine has_any ("-v","/v"), "SevenZipVolume",
      FileName in~ ("rar.exe","winrar.exe") and ProcessCommandLine has_any ("-v","/v"), "RarVolume",
      ProcessCommandLine has_any ("split -b","split -n","--bytes"), "UnixSplit",
      "GenericChunkFlag"
    )
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
           InitiatingProcessFileName, InitiatingProcessCommandLine, SignalType;
// Part 2: File creation — sequentially numbered archive chunk files appearing in bursts
let ChunkFileResults =
  DeviceFileEvents
  | where Timestamp > ago(24h)
  | where ActionType == "FileCreated"
  | where FileName matches regex @"(?i)\.(00[1-9]|0[1-9][0-9]|[0-9]{3})$"
      or FileName matches regex @"(?i)\.(7z|zip|rar|tar|gz|bz2)\.[0-9]{1,3}$"
      or FileName matches regex @"(?i)\.part[0-9]{1,4}$"
      or FileName matches regex @"(?i)\.r[0-9]{2}$"
  | summarize
      ChunkCount = count(),
      FirstSeen = min(Timestamp),
      LastSeen = max(Timestamp),
      SampleFiles = make_set(FileName, 10),
      FolderPaths = make_set(FolderPath, 5)
    by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 10m)
  | where ChunkCount >= 3
  | extend SignalType = "SequentialChunkFilesCreated"
  | project
      Timestamp = FirstSeen, DeviceName, AccountName,
      FileName = tostring(SampleFiles),
      ProcessCommandLine = strcat("ChunkCount=", ChunkCount, " Folder=", tostring(FolderPaths)),
      InitiatingProcessFileName,
      InitiatingProcessCommandLine = "",
      SignalType;
union ChunkResults, ChunkFileResults
| sort by Timestamp desc

| union
  [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
   (Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zr.exe"
    OR Image="*\\rar.exe" OR Image="*\\WinRAR.exe" OR Image="*\\rclone.exe")
   (
     CommandLine="* -v*" OR CommandLine="* /v*" OR CommandLine="*-volume*"
     OR CommandLine="*--max-size*" OR CommandLine="*--chunk-size*"
     OR CommandLine="*chunker*"
   )
  | eval SignalType=case(
      match(Image,"(?i)rclone") AND match(CommandLine,"chunker"),         "RcloneChunker",
      match(Image,"(?i)rclone") AND match(CommandLine,"--max-size"),       "RcloneMaxSize",
      match(Image,"(?i)(7z|7za|7zr)") AND match(CommandLine,"\s(-v|/v)"), "SevenZipVolume",
      match(Image,"(?i)(rar|winrar)") AND match(CommandLine,"\s(-v|/v)"), "RarVolume",
      1=1, "GenericChunkFlag"
    )
  | eval DetectionSource="ProcessCreation"
  | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, SignalType, DetectionSource]
[search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.001" OR TargetFilename="*.002" OR TargetFilename="*.003"
   OR TargetFilename="*.part1" OR TargetFilename="*.part2" OR TargetFilename="*.r00"
   OR TargetFilename="*.r01" OR TargetFilename="*.7z.001" OR TargetFilename="*.zip.001"
   OR TargetFilename="*.rar.001")
| eval SignalType="SequentialChunkFile"
| eval DetectionSource="FileCreation"
| stats count as ChunkFileCount, values(TargetFilename) as ChunkFiles, earliest(_time) as FirstSeen, latest(_time) as LastSeen
    by host, User, Image, SignalType, DetectionSource
| where ChunkFileCount >= 3
| eval _time=FirstSeen
| table _time, host, User, Image, ChunkFiles, ChunkFileCount, SignalType, DetectionSource]
| sort - _time

sequence by host.id with maxspan=10m
  [process where event.type == "start"
    and (
      process.name in~ ("7z", "7za", "7zr", "7z.exe", "7za.exe", "7zr.exe", "rar", "rar.exe", "winrar.exe", "rclone", "rclone.exe")
      or (
        process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
        and process.args : ("*-v*", "*--max-size*", "*--chunk-size*", "*chunker*", "*split -b*", "*split -n*", "*--bytes*")
      )
    )
    and process.command_line : ("* -v*", "* /v*", "*-volume*", "*--max-size*", "*--chunk-size*", "*chunker*", "*split -b*", "*split -n*", "*--bytes*", "*-v10m*", "*-v50m*", "*-v100m*", "*-v500m*", "*-v1g*")
  ] by process.entity_id

any where (
  (
    event.category == "process" and event.type == "start"
    and process.name in~ ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe", "rclone.exe", "7z", "7za", "rclone", "rar")
    and process.command_line : ("* -v*", "* /v*", "*--max-size*", "*--chunk-size*", "*chunker*", "*split -b*", "*split -n*", "*--bytes*")
  )
  or
  (
    event.category == "file" and event.type == "creation"
    and (
      file.name : ("*.001", "*.002", "*.003", "*.004", "*.005",
                   "*.part1", "*.part2", "*.part3",
                   "*.r00", "*.r01", "*.r02",
                   "*.7z.001", "*.zip.001", "*.rar.001",
                   "*.tar.001", "*.gz.001")
    )
  )
)

-- Part 1: Process creation with volume/chunk splitting flags
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "sourceip" AS HostIP,
  username,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  "Parent Process Name" AS ParentProcess,
  CASE
    WHEN LOWER("Process Name") LIKE '%rclone%' AND "Command" LIKE '%chunker%' THEN 'RcloneChunker'
    WHEN LOWER("Process Name") LIKE '%rclone%' AND "Command" LIKE '%--max-size%' THEN 'RcloneMaxSize'
    WHEN (LOWER("Process Name") LIKE '%7z%' OR LOWER("Process Name") LIKE '%7za%' OR LOWER("Process Name") LIKE '%7zr%')
         AND ("Command" LIKE '% -v%' OR "Command" LIKE '% /v%') THEN 'SevenZipVolume'
    WHEN (LOWER("Process Name") LIKE '%rar%' OR LOWER("Process Name") LIKE '%winrar%')
         AND ("Command" LIKE '% -v%' OR "Command" LIKE '% /v%') THEN 'RarVolume'
    WHEN "Command" LIKE '%split -b%' OR "Command" LIKE '%split -n%' OR "Command" LIKE '%--%bytes%' THEN 'UnixSplit'
    ELSE 'GenericChunkFlag'
  END AS SignalType,
  'ProcessCreation' AS DetectionSource
FROM events
WHERE devicetime > NOW() - 86400000
  AND LOGSOURCETYPEID(logsourceid) IN (12, 13, 352, 396)
  AND QIDNAME(qid) IN ('Process Creation', 'Windows Sysmon Process Created')
  AND (
    LOWER("Process Name") LIKE '%7z.exe' OR LOWER("Process Name") LIKE '%7za.exe'
    OR LOWER("Process Name") LIKE '%7zr.exe' OR LOWER("Process Name") LIKE '%rar.exe'
    OR LOWER("Process Name") LIKE '%winrar.exe' OR LOWER("Process Name") LIKE '%rclone.exe'
    OR LOWER("Process Name") LIKE '%/7z' OR LOWER("Process Name") LIKE '%/rclone'
  )
  AND (
    "Command" LIKE '% -v%' OR "Command" LIKE '% /v%'
    OR "Command" LIKE '%--max-size%' OR "Command" LIKE '%--chunk-size%'
    OR "Command" LIKE '%chunker%' OR "Command" LIKE '%split -b%'
    OR "Command" LIKE '%split -n%' OR "Command" LIKE '%--bytes%'
    OR "Command" LIKE '%-v10m%' OR "Command" LIKE '%-v50m%'
    OR "Command" LIKE '%-v100m%' OR "Command" LIKE '%-v500m%'
    OR "Command" LIKE '%-v1g%'
  )
UNION ALL
-- Part 2: File creation events matching sequential chunk naming
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "sourceip" AS HostIP,
  username,
  "Process Name" AS ProcessName,
  "Target File Name" AS CommandLine,
  NULL AS ParentProcess,
  'SequentialChunkFile' AS SignalType,
  'FileCreation' AS DetectionSource
FROM events
WHERE devicetime > NOW() - 86400000
  AND LOGSOURCETYPEID(logsourceid) IN (12, 13, 352, 396)
  AND QIDNAME(qid) IN ('File Created', 'Windows Sysmon File Created')
  AND (
    "Target File Name" LIKE '%.001' OR "Target File Name" LIKE '%.002'
    OR "Target File Name" LIKE '%.003' OR "Target File Name" LIKE '%.004'
    OR "Target File Name" LIKE '%.part1' OR "Target File Name" LIKE '%.part2'
    OR "Target File Name" LIKE '%.part3' OR "Target File Name" LIKE '%.r00'
    OR "Target File Name" LIKE '%.r01' OR "Target File Name" LIKE '%.7z.001'
    OR "Target File Name" LIKE '%.zip.001' OR "Target File Name" LIKE '%.rar.001'
    OR "Target File Name" LIKE '%.tar.001'
  )
ORDER BY EventTime DESC

// Part 1: Process creation — compression/transfer tools with chunk/volume flags
(_sourceCategory=*windows* OR _sourceCategory=*endpoint* OR _sourceCategory=*sysmon*)
| where EventID = "1" or EventCode = "1"
| parse field=CommandLine "*" as cmd_full nodrop
| where (
    (
      Image matches "*\\7z.exe" or Image matches "*\\7za.exe" or Image matches "*\\7zr.exe"
      or Image matches "*\\rar.exe" or Image matches "*\\WinRAR.exe" or Image matches "*\\rclone.exe"
      or Image matches "*/7z" or Image matches "*/rclone"
    )
    and (
      CommandLine matches "* -v*" or CommandLine matches "* /v*"
      or CommandLine matches "*--max-size*" or CommandLine matches "*--chunk-size*"
      or CommandLine matches "*chunker*" or CommandLine matches "*split -b*"
      or CommandLine matches "*split -n*" or CommandLine matches "*--bytes*"
      or CommandLine matches "*-v10m*" or CommandLine matches "*-v50m*"
      or CommandLine matches "*-v100m*" or CommandLine matches "*-v500m*"
      or CommandLine matches "*-v1g*"
    )
  )
| if (Image matches "*rclone*" and CommandLine matches "*chunker*", "RcloneChunker",
     if (Image matches "*rclone*" and CommandLine matches "*--max-size*", "RcloneMaxSize",
         if ((Image matches "*7z*") and (CommandLine matches "* -v*" or CommandLine matches "* /v*"), "SevenZipVolume",
             if ((Image matches "*rar*" or Image matches "*winrar*") and (CommandLine matches "* -v*" or CommandLine matches "* /v*"), "RarVolume",
                 if (CommandLine matches "*split -b*" or CommandLine matches "*split -n*" or CommandLine matches "*--bytes*", "UnixSplit",
                     "GenericChunkFlag"))))) as SignalType
| eval DetectionSource = "ProcessCreation"
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, SignalType, DetectionSource

// Part 2 — run as separate query, then correlate:
// (_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
// | where EventID = "11" or EventCode = "11"
// | where TargetFilename matches "*.001" or TargetFilename matches "*.002"
//     or TargetFilename matches "*.003" or TargetFilename matches "*.part1"
//     or TargetFilename matches "*.part2" or TargetFilename matches "*.r00"
//     or TargetFilename matches "*.r01" or TargetFilename matches "*.7z.001"
//     or TargetFilename matches "*.zip.001" or TargetFilename matches "*.rar.001"
// | timeslice 10m
// | stats count as ChunkFileCount, values(TargetFilename) as ChunkFiles,
//         first(Computer) as Host, first(User) as User, first(Image) as Process
//   by _timeslice, Host
// | where ChunkFileCount >= 3
// | eval SignalType = "SequentialChunkFilesCreated"
// | eval DetectionSource = "FileCreation"
// | fields _timeslice, Host, User, Process, ChunkFiles, ChunkFileCount, SignalType, DetectionSource

rule t1030_data_transfer_size_limits {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1030 Data Transfer Size Limits — compression/transfer tools invoked with volume splitting or chunk-size flags, and sequential chunk archive file creation. Covers 7-Zip, RAR/WinRAR, Rclone, and Unix split."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1030"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1030/"
    severity = "MEDIUM"
    priority = "MEDIUM"
    version = "1.0"
    created = "2026-04-16"
    platforms = "Windows, Linux"

  events:
    // Signal 1: Process creation with chunk/volume flags on known tools
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.hostname = $hostname
    (
      re.regex($proc.target.process.file.full_path, `(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe|rclone\.exe|/7z$|/7za$|/rclone$|/rar$)`) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|bash|/sh$)`) and
        re.regex($proc.target.process.command_line, `(?i)(\s-v\s|\s/v\s|--max-size|--chunk-size|chunker|split\s-b|split\s-n|--bytes|-v[0-9]+[kmg])`)
      )
    )
    re.regex($proc.target.process.command_line, `(?i)(\s-v[\s0-9]|\s/v[\s0-9]|\s-v[0-9]|--max-size|--chunk-size|chunker|split\s-b|split\s-n|--bytes|-v10m|-v50m|-v100m|-v500m|-v1g|-v1024)`)

  match:
    $hostname over 10m

  outcome:
    $risk_score = max(
      if($proc.target.process.file.full_path = "/rclone/" and re.regex($proc.target.process.command_line, "chunker"), 85,
         if($proc.target.process.file.full_path = "/rclone/" and re.regex($proc.target.process.command_line, "--max-size"), 80,
            if(re.regex($proc.target.process.file.full_path, `(?i)(7z|7za|7zr)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), 75,
               if(re.regex($proc.target.process.file.full_path, `(?i)(rar|winrar)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), 75,
                  65)
            )
         )
      )
    )
    $signal_type = if(
      re.regex($proc.target.process.file.full_path, `(?i)rclone`) and re.regex($proc.target.process.command_line, `chunker`), "RcloneChunker",
      if(re.regex($proc.target.process.file.full_path, `(?i)rclone`) and re.regex($proc.target.process.command_line, `--max-size`), "RcloneMaxSize",
         if(re.regex($proc.target.process.file.full_path, `(?i)(7z|7za|7zr)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), "SevenZipVolume",
            if(re.regex($proc.target.process.file.full_path, `(?i)(rar|winrar)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), "RarVolume",
               if(re.regex($proc.target.process.command_line, `split\s-[bn]|--bytes`), "UnixSplit",
                  "GenericChunkFlag"))))
    )

  condition:
    $proc
}

rule t1030_sequential_chunk_files {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1030 Data Transfer Size Limits — 3 or more sequentially numbered archive chunk files created on the same host within 10 minutes, indicating active data chunking for exfiltration."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1030"
    severity = "MEDIUM"
    priority = "MEDIUM"
    version = "1.0"
    created = "2026-04-16"

  events:
    $file.metadata.event_type = "FILE_CREATION"
    $file.principal.hostname = $hostname
    re.regex($file.target.file.full_path,
      `(?i)(\.(00[1-9]|0[1-9][0-9]|[0-9]{3})$|\.part[0-9]{1,4}$|\.r[0-9]{2}$|(7z|zip|rar|tar|gz|bz2)\.[0-9]{1,3}$)`
    )

  match:
    $hostname over 10m

  outcome:
    $risk_score = 70
    $chunk_count = count($file.target.file.full_path)
    $signal_type = "SequentialChunkFilesCreated"

  condition:
    #file >= 3
}

// Part 1: Process creation — compression/transfer tools with volume/chunk flags
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe|rclone\.exe|\/7z$|\/7za$|\/rclone$|\/rar$)/
| CommandLine = /(?i)(\s-v[\s0-9]|\s\/v[\s0-9]|--max-size|--chunk-size|chunker|split\s-[bn]|--bytes|-v10m|-v50m|-v100m|-v500m|-v1g|-v1024)/
| SignalType := case(
    CommandLine = /(?i)rclone/ AND CommandLine = /chunker/, "RcloneChunker",
    CommandLine = /(?i)rclone/ AND CommandLine = /--max-size/, "RcloneMaxSize",
    ImageFileName = /(?i)(7z|7za|7zr)\.exe/ AND CommandLine = /(\s-v|\s\/v)/, "SevenZipVolume",
    ImageFileName = /(?i)(rar|winrar)\.exe/ AND CommandLine = /(\s-v|\s\/v)/, "RarVolume",
    CommandLine = /split\s-[bn]|--bytes/, "UnixSplit",
    * , "GenericChunkFlag"
  )
| table([_timeutc, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SignalType])

// ----

// Part 2: File write events — sequentially numbered archive chunk files
// Run as separate query
#event_simpleName=PeFileWritten OR #event_simpleName=ScriptFileWritten OR #event_simpleName=SuspiciousWrittenFile
| TargetFileName = /(?i)(\.(00[1-9]|0[1-9][0-9]|[0-9]{3})$|\.part[0-9]{1,4}$|\.r[0-9]{2}$|(7z|zip|rar|tar|gz|bz2)\.[0-9]{1,3}$)/
| groupBy([ComputerName, UserName, ParentBaseFileName], function=[
    count(as=ChunkFileCount),
    collect(TargetFileName, as=ChunkFiles, limit=10),
    min(_timeutc, as=FirstSeen),
    max(_timeutc, as=LastSeen)
  ])
| ChunkFileCount >= 3
| SignalType := "SequentialChunkFilesCreated"
| table([FirstSeen, ComputerName, UserName, ParentBaseFileName, ChunkFiles, ChunkFileCount, SignalType])
| sort(FirstSeen, order=desc)