Which SIEM platforms have a T1030 detection rule?

df00tech provides T1030 (Data Transfer Size Limits) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Data Transfer Size Limits (T1030)?

Detecting Data Transfer Size Limits requires the following data sources: Process: Process Creation, File: File Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1030 detection?

The T1030 detection is rated medium severity with medium confidence.

What are common false positives for T1030?

Common false positives for T1030 include: Legitimate backup software (Veeam, Backup Exec, Acronis) that splits archive volumes by size for storage media compatibility; IT administrators manually splitting large log archives or database exports for transfer to off-site storage or ticketing systems; Cloud sync tools (Rclone, rsync wrappers) configured by ops teams to use chunk uploads to cloud storage (S3, GCS, Azure Blob) for large dataset transfers.

T1030 IBM QRadar · QRadar

Detect Data Transfer Size Limits in IBM QRadar

Adversaries may exfiltrate data in fixed size chunks instead of whole files, or limit packet sizes below certain thresholds, to avoid triggering network data transfer threshold alerts. Techniques include splitting archives into equal-sized volumes (e.g., 7-Zip -v flag, RAR split volumes), using tools like Rclone with chunker overlay, scripting custom byte-range reads, or configuring C2 implants with fixed send-buffer sizes. Real-world actors including APT28, LuminousMoth, Threat Group-3390, Play ransomware, and malware families like Cobalt Strike, POSHSPY, OopsIE, and StealBit all employ this technique. Detection pivots to file-system artifacts (sequentially numbered archive parts), process command-line analysis (volume-size flags on compression utilities), and network behavioral analysis (repeated uniform-size connections to the same external host).

MITRE ATT&CK

Tactic: Exfiltration
Technique: T1030 Data Transfer Size Limits
Canonical reference: https://attack.mitre.org/techniques/T1030/

QRadar Detection Query

IBM QRadar (QRadar)

sql

-- Part 1: Process creation with volume/chunk splitting flags
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "sourceip" AS HostIP,
  username,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  "Parent Process Name" AS ParentProcess,
  CASE
    WHEN LOWER("Process Name") LIKE '%rclone%' AND "Command" LIKE '%chunker%' THEN 'RcloneChunker'
    WHEN LOWER("Process Name") LIKE '%rclone%' AND "Command" LIKE '%--max-size%' THEN 'RcloneMaxSize'
    WHEN (LOWER("Process Name") LIKE '%7z%' OR LOWER("Process Name") LIKE '%7za%' OR LOWER("Process Name") LIKE '%7zr%')
         AND ("Command" LIKE '% -v%' OR "Command" LIKE '% /v%') THEN 'SevenZipVolume'
    WHEN (LOWER("Process Name") LIKE '%rar%' OR LOWER("Process Name") LIKE '%winrar%')
         AND ("Command" LIKE '% -v%' OR "Command" LIKE '% /v%') THEN 'RarVolume'
    WHEN "Command" LIKE '%split -b%' OR "Command" LIKE '%split -n%' OR "Command" LIKE '%--%bytes%' THEN 'UnixSplit'
    ELSE 'GenericChunkFlag'
  END AS SignalType,
  'ProcessCreation' AS DetectionSource
FROM events
WHERE devicetime > NOW() - 86400000
  AND LOGSOURCETYPEID(logsourceid) IN (12, 13, 352, 396)
  AND QIDNAME(qid) IN ('Process Creation', 'Windows Sysmon Process Created')
  AND (
    LOWER("Process Name") LIKE '%7z.exe' OR LOWER("Process Name") LIKE '%7za.exe'
    OR LOWER("Process Name") LIKE '%7zr.exe' OR LOWER("Process Name") LIKE '%rar.exe'
    OR LOWER("Process Name") LIKE '%winrar.exe' OR LOWER("Process Name") LIKE '%rclone.exe'
    OR LOWER("Process Name") LIKE '%/7z' OR LOWER("Process Name") LIKE '%/rclone'
  )
  AND (
    "Command" LIKE '% -v%' OR "Command" LIKE '% /v%'
    OR "Command" LIKE '%--max-size%' OR "Command" LIKE '%--chunk-size%'
    OR "Command" LIKE '%chunker%' OR "Command" LIKE '%split -b%'
    OR "Command" LIKE '%split -n%' OR "Command" LIKE '%--bytes%'
    OR "Command" LIKE '%-v10m%' OR "Command" LIKE '%-v50m%'
    OR "Command" LIKE '%-v100m%' OR "Command" LIKE '%-v500m%'
    OR "Command" LIKE '%-v1g%'
  )
UNION ALL
-- Part 2: File creation events matching sequential chunk naming
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "sourceip" AS HostIP,
  username,
  "Process Name" AS ProcessName,
  "Target File Name" AS CommandLine,
  NULL AS ParentProcess,
  'SequentialChunkFile' AS SignalType,
  'FileCreation' AS DetectionSource
FROM events
WHERE devicetime > NOW() - 86400000
  AND LOGSOURCETYPEID(logsourceid) IN (12, 13, 352, 396)
  AND QIDNAME(qid) IN ('File Created', 'Windows Sysmon File Created')
  AND (
    "Target File Name" LIKE '%.001' OR "Target File Name" LIKE '%.002'
    OR "Target File Name" LIKE '%.003' OR "Target File Name" LIKE '%.004'
    OR "Target File Name" LIKE '%.part1' OR "Target File Name" LIKE '%.part2'
    OR "Target File Name" LIKE '%.part3' OR "Target File Name" LIKE '%.r00'
    OR "Target File Name" LIKE '%.r01' OR "Target File Name" LIKE '%.7z.001'
    OR "Target File Name" LIKE '%.zip.001' OR "Target File Name" LIKE '%.rar.001'
    OR "Target File Name" LIKE '%.tar.001'
  )
ORDER BY EventTime DESC

medium severity medium confidence

Detects T1030 Data Transfer Size Limits in IBM QRadar via AQL UNION of two event streams: process creation events (LOGSOURCE types for Windows Security/Sysmon) where known compression or transfer tools are invoked with volume-splitting arguments (-v, /v, --max-size, --chunk-size, chunker, split -b/n), and Sysmon file creation events (Event ID 11) where created filenames match sequential chunk naming patterns (.001, .part1, .r00, .7z.001). Covers 7-Zip, RAR/WinRAR, Rclone, and Unix split. Signal type classification mirrors the KQL/SPL reference detections.

Data Sources

IBM QRadar SIEMMicrosoft Windows Security Event Log (via QRadar DSM)Sysmon via QRadar Windows Sysmon DSMLinux Audit via QRadar Linux OS DSM

Required Tables

events

False Positives & Tuning

Backup software (Veeam, Acronis, Windows Server Backup) creating split volume archives with sequential numbering as part of scheduled backup jobs
Authorized rclone usage by cloud operations teams performing scheduled data synchronization with max-size constraints to avoid API throttling
Software distribution systems splitting large installer packages into multi-volume archives for network delivery to endpoints with limited bandwidth
Database export jobs that produce sequentially numbered output files as a natural artifact of parallel export tooling
Media encoding pipelines generating segment files with numeric suffixes that superficially match archive chunk patterns (e.g., HLS .ts segments)

Download portable Sigma rule (.yml)

Other platforms for T1030

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Split file into fixed-size chunks using Unix split command
Expected signal: Linux auditd SYSCALL records for execve() invoking dd and split with arguments. Sysmon for Linux (if deployed) Event ID 1 (ProcessCreate) with Image=/usr/bin/split, CommandLine containing '-b 102400'. File creation events (Sysmon Event ID 11) for /tmp/argus_chunk_00, /tmp/argus_chunk_01, etc. The ls output confirms 5 files of approximately 100KB each.
Test 2Create split 7-Zip archive with volume size flag
Expected signal: Sysmon Event ID 1 (Process Create): Image=C:\Program Files\7-Zip\7z.exe, CommandLine containing 'a -v1m' and the target path. Sysmon Event ID 11 (File Create): Multiple events for argus_exfil_chunks.7z.001 through .005 in %TEMP%. Security Event ID 4688 (if command line auditing enabled) with same process details. PowerShell/cmd parent process event visible if launched from a script.
Test 3PowerShell fixed-size file chunking script (implant-style)
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing ReadAllBytes, WriteAllBytes, and chunkSize=2048. Sysmon Event ID 11 (File Create): Multiple events for argus_chunk_000, argus_chunk_001, etc. in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 will capture the full chunking logic. No compression tool invocation — this tests the file-creation-based detection branch.
Test 4Rclone file exfiltration with chunk size limit
Expected signal: Sysmon Event ID 1 (Process Create): Image=rclone.exe (or full path), CommandLine containing 'copy', '--max-size', '--transfers'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 3 (Network Connection) would fire if targeting a real remote — absent here due to local target. If rclone is not present the test exits gracefully with a message.

Last updated: 2026-04-16 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1030 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Data Transfer Size Limits in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1030

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Exfiltration

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1030

Testing Methodology

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Exfiltration

Popular Detections

Get new detections in your inbox