Detect Data Transfer Size Limits in Microsoft Sentinel

// T1030 — Data Transfer Size Limits
// Part 1: Process creation — compression/transfer tools with volume/chunk-size flags
let SplittingTools = dynamic(["7z.exe","7za.exe","7zr.exe","rar.exe","winrar.exe","rclone.exe","split"]);
let VolumeFlagPatterns = dynamic([
  " -v", "/v", "-volume", "--max-size", "--chunk-size",
  "chunker", "split -b", "split -n", "--bytes",
  "-v10m","-v50m","-v100m","-v500m","-v1g","-v1024"
]);
let ChunkResults =
  DeviceProcessEvents
  | where Timestamp > ago(24h)
  | where FileName in~ (SplittingTools)
      or (FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh") and ProcessCommandLine has_any (VolumeFlagPatterns))
  | where ProcessCommandLine has_any (VolumeFlagPatterns)
  | extend SignalType = case(
      FileName =~ "rclone.exe" and ProcessCommandLine has "chunker", "RcloneChunker",
      FileName =~ "rclone.exe" and ProcessCommandLine has "--max-size", "RcloneMaxSize",
      FileName in~ ("7z.exe","7za.exe","7zr.exe") and ProcessCommandLine has_any ("-v","/v"), "SevenZipVolume",
      FileName in~ ("rar.exe","winrar.exe") and ProcessCommandLine has_any ("-v","/v"), "RarVolume",
      ProcessCommandLine has_any ("split -b","split -n","--bytes"), "UnixSplit",
      "GenericChunkFlag"
    )
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
           InitiatingProcessFileName, InitiatingProcessCommandLine, SignalType;
// Part 2: File creation — sequentially numbered archive chunk files appearing in bursts
let ChunkFileResults =
  DeviceFileEvents
  | where Timestamp > ago(24h)
  | where ActionType == "FileCreated"
  | where FileName matches regex @"(?i)\.(00[1-9]|0[1-9][0-9]|[0-9]{3})$"
      or FileName matches regex @"(?i)\.(7z|zip|rar|tar|gz|bz2)\.[0-9]{1,3}$"
      or FileName matches regex @"(?i)\.part[0-9]{1,4}$"
      or FileName matches regex @"(?i)\.r[0-9]{2}$"
  | summarize
      ChunkCount = count(),
      FirstSeen = min(Timestamp),
      LastSeen = max(Timestamp),
      SampleFiles = make_set(FileName, 10),
      FolderPaths = make_set(FolderPath, 5)
    by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 10m)
  | where ChunkCount >= 3
  | extend SignalType = "SequentialChunkFilesCreated"
  | project
      Timestamp = FirstSeen, DeviceName, AccountName,
      FileName = tostring(SampleFiles),
      ProcessCommandLine = strcat("ChunkCount=", ChunkCount, " Folder=", tostring(FolderPaths)),
      InitiatingProcessFileName,
      InitiatingProcessCommandLine = "",
      SignalType;
union ChunkResults, ChunkFileResults
| sort by Timestamp desc