Detect Data Transfer Size Limits in Elastic Security
Adversaries may exfiltrate data in fixed size chunks instead of whole files, or limit packet sizes below certain thresholds, to avoid triggering network data transfer threshold alerts. Techniques include splitting archives into equal-sized volumes (e.g., 7-Zip -v flag, RAR split volumes), using tools like Rclone with chunker overlay, scripting custom byte-range reads, or configuring C2 implants with fixed send-buffer sizes. Real-world actors including APT28, LuminousMoth, Threat Group-3390, Play ransomware, and malware families like Cobalt Strike, POSHSPY, OopsIE, and StealBit all employ this technique. Detection pivots to file-system artifacts (sequentially numbered archive parts), process command-line analysis (volume-size flags on compression utilities), and network behavioral analysis (repeated uniform-size connections to the same external host).
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1030 Data Transfer Size Limits
- Canonical reference
- https://attack.mitre.org/techniques/T1030/
Elastic Detection Query
sequence by host.id with maxspan=10m
[process where event.type == "start"
and (
process.name in~ ("7z", "7za", "7zr", "7z.exe", "7za.exe", "7zr.exe", "rar", "rar.exe", "winrar.exe", "rclone", "rclone.exe")
or (
process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
and process.args : ("*-v*", "*--max-size*", "*--chunk-size*", "*chunker*", "*split -b*", "*split -n*", "*--bytes*")
)
)
and process.command_line : ("* -v*", "* /v*", "*-volume*", "*--max-size*", "*--chunk-size*", "*chunker*", "*split -b*", "*split -n*", "*--bytes*", "*-v10m*", "*-v50m*", "*-v100m*", "*-v500m*", "*-v1g*")
] by process.entity_id
any where (
(
event.category == "process" and event.type == "start"
and process.name in~ ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe", "rclone.exe", "7z", "7za", "rclone", "rar")
and process.command_line : ("* -v*", "* /v*", "*--max-size*", "*--chunk-size*", "*chunker*", "*split -b*", "*split -n*", "*--bytes*")
)
or
(
event.category == "file" and event.type == "creation"
and (
file.name : ("*.001", "*.002", "*.003", "*.004", "*.005",
"*.part1", "*.part2", "*.part3",
"*.r00", "*.r01", "*.r02",
"*.7z.001", "*.zip.001", "*.rar.001",
"*.tar.001", "*.gz.001")
)
)
)Detects T1030 Data Transfer Size Limits via two correlated signals: (1) process creation events for known compression/transfer tools invoked with volume-splitting or chunk-size flags (-v, /v, --max-size, --chunk-size, chunker, split -b/n), and (2) file creation events matching sequentially numbered archive chunk naming patterns (.001/.002, .part1/.part2, .r00/.r01, .7z.001). Uses a 10-minute correlation window per host. Covers 7-Zip, RAR/WinRAR, Rclone, and Unix split utilities across both Windows and Linux endpoints.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT backup operations using 7-Zip or Rclone with volume splitting to fit archives onto removable media or comply with cloud storage upload limits
- Software deployment pipelines or CI/CD systems that package large artifacts into split archives for distribution across constrained storage tiers
- System administrators using rclone with --max-size or chunker for authorized cloud migration or data tiering tasks documented in change management
- Developer workflows splitting large dataset files into chunks for parallel processing or upload to object storage (S3, GCS, Azure Blob)
- Antivirus or endpoint detection products quarantining files using numbered chunk naming conventions that match .001/.002 patterns
Other platforms for T1030
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Split file into fixed-size chunks using Unix split command
Expected signal: Linux auditd SYSCALL records for execve() invoking dd and split with arguments. Sysmon for Linux (if deployed) Event ID 1 (ProcessCreate) with Image=/usr/bin/split, CommandLine containing '-b 102400'. File creation events (Sysmon Event ID 11) for /tmp/argus_chunk_00, /tmp/argus_chunk_01, etc. The ls output confirms 5 files of approximately 100KB each.
- Test 2Create split 7-Zip archive with volume size flag
Expected signal: Sysmon Event ID 1 (Process Create): Image=C:\Program Files\7-Zip\7z.exe, CommandLine containing 'a -v1m' and the target path. Sysmon Event ID 11 (File Create): Multiple events for argus_exfil_chunks.7z.001 through .005 in %TEMP%. Security Event ID 4688 (if command line auditing enabled) with same process details. PowerShell/cmd parent process event visible if launched from a script.
- Test 3PowerShell fixed-size file chunking script (implant-style)
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing ReadAllBytes, WriteAllBytes, and chunkSize=2048. Sysmon Event ID 11 (File Create): Multiple events for argus_chunk_000, argus_chunk_001, etc. in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 will capture the full chunking logic. No compression tool invocation — this tests the file-creation-based detection branch.
- Test 4Rclone file exfiltration with chunk size limit
Expected signal: Sysmon Event ID 1 (Process Create): Image=rclone.exe (or full path), CommandLine containing 'copy', '--max-size', '--transfers'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 3 (Network Connection) would fire if targeting a real remote — absent here due to local target. If rclone is not present the test exits gracefully with a message.
References (12)
- https://attack.mitre.org/techniques/T1030/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
- https://www.trendmicro.com/en_us/research/23/g/play-ransomware-spotlight.html
- https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-stealer-and-a-possible-china-nexus-link/
- https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/
- https://www.mandiant.com/resources/blog/poshspy-backdoor-powershell
- https://www.welivesecurity.com/2018/12/05/forssh-kessel-run-ssh-botnet/
- https://unit42.paloaltonetworks.com/rdat-new-oilrig-backdoor/
- https://rclone.org/chunker/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
- https://www.cybereason.com/blog/research/threat-analysis-report-stealbit-the-custom-exfiltration-tool-of-lockbit
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
Unlock Pro Content
Get the full detection package for T1030 including response playbook, investigation guide, and atomic red team tests.