Detect Data Transfer Size Limits in Google Chronicle

rule t1030_data_transfer_size_limits {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1030 Data Transfer Size Limits — compression/transfer tools invoked with volume splitting or chunk-size flags, and sequential chunk archive file creation. Covers 7-Zip, RAR/WinRAR, Rclone, and Unix split."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1030"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1030/"
    severity = "MEDIUM"
    priority = "MEDIUM"
    version = "1.0"
    created = "2026-04-16"
    platforms = "Windows, Linux"

  events:
    // Signal 1: Process creation with chunk/volume flags on known tools
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.hostname = $hostname
    (
      re.regex($proc.target.process.file.full_path, `(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe|rclone\.exe|/7z$|/7za$|/rclone$|/rar$)`) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|bash|/sh$)`) and
        re.regex($proc.target.process.command_line, `(?i)(\s-v\s|\s/v\s|--max-size|--chunk-size|chunker|split\s-b|split\s-n|--bytes|-v[0-9]+[kmg])`)
      )
    )
    re.regex($proc.target.process.command_line, `(?i)(\s-v[\s0-9]|\s/v[\s0-9]|\s-v[0-9]|--max-size|--chunk-size|chunker|split\s-b|split\s-n|--bytes|-v10m|-v50m|-v100m|-v500m|-v1g|-v1024)`)

  match:
    $hostname over 10m

  outcome:
    $risk_score = max(
      if($proc.target.process.file.full_path = "/rclone/" and re.regex($proc.target.process.command_line, "chunker"), 85,
         if($proc.target.process.file.full_path = "/rclone/" and re.regex($proc.target.process.command_line, "--max-size"), 80,
            if(re.regex($proc.target.process.file.full_path, `(?i)(7z|7za|7zr)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), 75,
               if(re.regex($proc.target.process.file.full_path, `(?i)(rar|winrar)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), 75,
                  65)
            )
         )
      )
    )
    $signal_type = if(
      re.regex($proc.target.process.file.full_path, `(?i)rclone`) and re.regex($proc.target.process.command_line, `chunker`), "RcloneChunker",
      if(re.regex($proc.target.process.file.full_path, `(?i)rclone`) and re.regex($proc.target.process.command_line, `--max-size`), "RcloneMaxSize",
         if(re.regex($proc.target.process.file.full_path, `(?i)(7z|7za|7zr)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), "SevenZipVolume",
            if(re.regex($proc.target.process.file.full_path, `(?i)(rar|winrar)\.exe`) and re.regex($proc.target.process.command_line, `(\s-v|\s/v)`), "RarVolume",
               if(re.regex($proc.target.process.command_line, `split\s-[bn]|--bytes`), "UnixSplit",
                  "GenericChunkFlag"))))
    )

  condition:
    $proc
}

rule t1030_sequential_chunk_files {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1030 Data Transfer Size Limits — 3 or more sequentially numbered archive chunk files created on the same host within 10 minutes, indicating active data chunking for exfiltration."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1030"
    severity = "MEDIUM"
    priority = "MEDIUM"
    version = "1.0"
    created = "2026-04-16"

  events:
    $file.metadata.event_type = "FILE_CREATION"
    $file.principal.hostname = $hostname
    re.regex($file.target.file.full_path,
      `(?i)(\.(00[1-9]|0[1-9][0-9]|[0-9]{3})$|\.part[0-9]{1,4}$|\.r[0-9]{2}$|(7z|zip|rar|tar|gz|bz2)\.[0-9]{1,3}$)`
    )

  match:
    $hostname over 10m

  outcome:
    $risk_score = 70
    $chunk_count = count($file.target.file.full_path)
    $signal_type = "SequentialChunkFilesCreated"

  condition:
    #file >= 3
}