Detect Data Transfer Size Limits in CrowdStrike LogScale
Adversaries may exfiltrate data in fixed size chunks instead of whole files, or limit packet sizes below certain thresholds, to avoid triggering network data transfer threshold alerts. Techniques include splitting archives into equal-sized volumes (e.g., 7-Zip -v flag, RAR split volumes), using tools like Rclone with chunker overlay, scripting custom byte-range reads, or configuring C2 implants with fixed send-buffer sizes. Real-world actors including APT28, LuminousMoth, Threat Group-3390, Play ransomware, and malware families like Cobalt Strike, POSHSPY, OopsIE, and StealBit all employ this technique. Detection pivots to file-system artifacts (sequentially numbered archive parts), process command-line analysis (volume-size flags on compression utilities), and network behavioral analysis (repeated uniform-size connections to the same external host).
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1030 Data Transfer Size Limits
- Canonical reference
- https://attack.mitre.org/techniques/T1030/
LogScale Detection Query
// Part 1: Process creation — compression/transfer tools with volume/chunk flags
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe|rclone\.exe|\/7z$|\/7za$|\/rclone$|\/rar$)/
| CommandLine = /(?i)(\s-v[\s0-9]|\s\/v[\s0-9]|--max-size|--chunk-size|chunker|split\s-[bn]|--bytes|-v10m|-v50m|-v100m|-v500m|-v1g|-v1024)/
| SignalType := case(
CommandLine = /(?i)rclone/ AND CommandLine = /chunker/, "RcloneChunker",
CommandLine = /(?i)rclone/ AND CommandLine = /--max-size/, "RcloneMaxSize",
ImageFileName = /(?i)(7z|7za|7zr)\.exe/ AND CommandLine = /(\s-v|\s\/v)/, "SevenZipVolume",
ImageFileName = /(?i)(rar|winrar)\.exe/ AND CommandLine = /(\s-v|\s\/v)/, "RarVolume",
CommandLine = /split\s-[bn]|--bytes/, "UnixSplit",
* , "GenericChunkFlag"
)
| table([_timeutc, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SignalType])
// ----
// Part 2: File write events — sequentially numbered archive chunk files
// Run as separate query
#event_simpleName=PeFileWritten OR #event_simpleName=ScriptFileWritten OR #event_simpleName=SuspiciousWrittenFile
| TargetFileName = /(?i)(\.(00[1-9]|0[1-9][0-9]|[0-9]{3})$|\.part[0-9]{1,4}$|\.r[0-9]{2}$|(7z|zip|rar|tar|gz|bz2)\.[0-9]{1,3}$)/
| groupBy([ComputerName, UserName, ParentBaseFileName], function=[
count(as=ChunkFileCount),
collect(TargetFileName, as=ChunkFiles, limit=10),
min(_timeutc, as=FirstSeen),
max(_timeutc, as=LastSeen)
])
| ChunkFileCount >= 3
| SignalType := "SequentialChunkFilesCreated"
| table([FirstSeen, ComputerName, UserName, ParentBaseFileName, ChunkFiles, ChunkFileCount, SignalType])
| sort(FirstSeen, order=desc)Detects T1030 Data Transfer Size Limits in CrowdStrike LogScale (Falcon SIEM) using two complementary CQL queries. Query 1 matches ProcessRollup2 events where known archive or transfer tool executables (7-Zip, RAR/WinRAR, Rclone) are launched with volume-splitting or chunk-size flags, using regex on ImageFileName and CommandLine with signal type classification. Query 2 aggregates Falcon file write telemetry events (PeFileWritten, ScriptFileWritten, SuspiciousWrittenFile) matching sequential chunk filename patterns, alerting when 3+ chunk files are written by the same process on the same host.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrator use of rclone for authorized cloud storage synchronization tasks with --max-size configured to comply with provider API rate limits
- Endpoint backup agents using 7-Zip or WinRAR in volume-split mode to create archives within size thresholds for upload to backup destinations
- IT provisioning or software deployment tools that create split package archives as part of documented software distribution workflows to managed endpoints
- Security product installers or EDR update packages delivered in multi-part archive formats that match sequential chunk file naming conventions
Other platforms for T1030
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Split file into fixed-size chunks using Unix split command
Expected signal: Linux auditd SYSCALL records for execve() invoking dd and split with arguments. Sysmon for Linux (if deployed) Event ID 1 (ProcessCreate) with Image=/usr/bin/split, CommandLine containing '-b 102400'. File creation events (Sysmon Event ID 11) for /tmp/argus_chunk_00, /tmp/argus_chunk_01, etc. The ls output confirms 5 files of approximately 100KB each.
- Test 2Create split 7-Zip archive with volume size flag
Expected signal: Sysmon Event ID 1 (Process Create): Image=C:\Program Files\7-Zip\7z.exe, CommandLine containing 'a -v1m' and the target path. Sysmon Event ID 11 (File Create): Multiple events for argus_exfil_chunks.7z.001 through .005 in %TEMP%. Security Event ID 4688 (if command line auditing enabled) with same process details. PowerShell/cmd parent process event visible if launched from a script.
- Test 3PowerShell fixed-size file chunking script (implant-style)
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing ReadAllBytes, WriteAllBytes, and chunkSize=2048. Sysmon Event ID 11 (File Create): Multiple events for argus_chunk_000, argus_chunk_001, etc. in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 will capture the full chunking logic. No compression tool invocation — this tests the file-creation-based detection branch.
- Test 4Rclone file exfiltration with chunk size limit
Expected signal: Sysmon Event ID 1 (Process Create): Image=rclone.exe (or full path), CommandLine containing 'copy', '--max-size', '--transfers'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 3 (Network Connection) would fire if targeting a real remote — absent here due to local target. If rclone is not present the test exits gracefully with a message.
References (12)
- https://attack.mitre.org/techniques/T1030/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
- https://www.trendmicro.com/en_us/research/23/g/play-ransomware-spotlight.html
- https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-stealer-and-a-possible-china-nexus-link/
- https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/
- https://www.mandiant.com/resources/blog/poshspy-backdoor-powershell
- https://www.welivesecurity.com/2018/12/05/forssh-kessel-run-ssh-botnet/
- https://unit42.paloaltonetworks.com/rdat-new-oilrig-backdoor/
- https://rclone.org/chunker/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
- https://www.cybereason.com/blog/research/threat-analysis-report-stealbit-the-custom-exfiltration-tool-of-lockbit
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
Unlock Pro Content
Get the full detection package for T1030 including response playbook, investigation guide, and atomic red team tests.