Detect Data Transfer Size Limits in Splunk
Adversaries may exfiltrate data in fixed size chunks instead of whole files, or limit packet sizes below certain thresholds, to avoid triggering network data transfer threshold alerts. Techniques include splitting archives into equal-sized volumes (e.g., 7-Zip -v flag, RAR split volumes), using tools like Rclone with chunker overlay, scripting custom byte-range reads, or configuring C2 implants with fixed send-buffer sizes. Real-world actors including APT28, LuminousMoth, Threat Group-3390, Play ransomware, and malware families like Cobalt Strike, POSHSPY, OopsIE, and StealBit all employ this technique. Detection pivots to file-system artifacts (sequentially numbered archive parts), process command-line analysis (volume-size flags on compression utilities), and network behavioral analysis (repeated uniform-size connections to the same external host).
MITRE ATT&CK
- Tactic
- Exfiltration
- Technique
- T1030 Data Transfer Size Limits
- Canonical reference
- https://attack.mitre.org/techniques/T1030/
SPL Detection Query
| union
[search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zr.exe"
OR Image="*\\rar.exe" OR Image="*\\WinRAR.exe" OR Image="*\\rclone.exe")
(
CommandLine="* -v*" OR CommandLine="* /v*" OR CommandLine="*-volume*"
OR CommandLine="*--max-size*" OR CommandLine="*--chunk-size*"
OR CommandLine="*chunker*"
)
| eval SignalType=case(
match(Image,"(?i)rclone") AND match(CommandLine,"chunker"), "RcloneChunker",
match(Image,"(?i)rclone") AND match(CommandLine,"--max-size"), "RcloneMaxSize",
match(Image,"(?i)(7z|7za|7zr)") AND match(CommandLine,"\s(-v|/v)"), "SevenZipVolume",
match(Image,"(?i)(rar|winrar)") AND match(CommandLine,"\s(-v|/v)"), "RarVolume",
1=1, "GenericChunkFlag"
)
| eval DetectionSource="ProcessCreation"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, SignalType, DetectionSource]
[search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.001" OR TargetFilename="*.002" OR TargetFilename="*.003"
OR TargetFilename="*.part1" OR TargetFilename="*.part2" OR TargetFilename="*.r00"
OR TargetFilename="*.r01" OR TargetFilename="*.7z.001" OR TargetFilename="*.zip.001"
OR TargetFilename="*.rar.001")
| eval SignalType="SequentialChunkFile"
| eval DetectionSource="FileCreation"
| stats count as ChunkFileCount, values(TargetFilename) as ChunkFiles, earliest(_time) as FirstSeen, latest(_time) as LastSeen
by host, User, Image, SignalType, DetectionSource
| where ChunkFileCount >= 3
| eval _time=FirstSeen
| table _time, host, User, Image, ChunkFiles, ChunkFileCount, SignalType, DetectionSource]
| sort - _timeDetects data chunking for exfiltration using two Sysmon event sources combined via SPL union: (1) Event ID 1 (Process Create) for compression/sync tool invocations with volume/chunk-size flags, categorized by tool type in SignalType, and (2) Event ID 11 (File Create) aggregated to surface bursts of 3 or more sequentially numbered archive chunk files created by the same process within a session. Both result sets share the SignalType and DetectionSource fields for unified analyst review.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate backup software splitting archives for storage media or cloud upload size limits
- IT administrator-initiated data migrations involving large split archives
- Rclone configured by ops teams for cloud storage with chunk uploads enabled
- Software distribution pipelines creating split installation packages
- Developers using 7-Zip or split for authorized large dataset archiving
Other platforms for T1030
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Split file into fixed-size chunks using Unix split command
Expected signal: Linux auditd SYSCALL records for execve() invoking dd and split with arguments. Sysmon for Linux (if deployed) Event ID 1 (ProcessCreate) with Image=/usr/bin/split, CommandLine containing '-b 102400'. File creation events (Sysmon Event ID 11) for /tmp/argus_chunk_00, /tmp/argus_chunk_01, etc. The ls output confirms 5 files of approximately 100KB each.
- Test 2Create split 7-Zip archive with volume size flag
Expected signal: Sysmon Event ID 1 (Process Create): Image=C:\Program Files\7-Zip\7z.exe, CommandLine containing 'a -v1m' and the target path. Sysmon Event ID 11 (File Create): Multiple events for argus_exfil_chunks.7z.001 through .005 in %TEMP%. Security Event ID 4688 (if command line auditing enabled) with same process details. PowerShell/cmd parent process event visible if launched from a script.
- Test 3PowerShell fixed-size file chunking script (implant-style)
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing ReadAllBytes, WriteAllBytes, and chunkSize=2048. Sysmon Event ID 11 (File Create): Multiple events for argus_chunk_000, argus_chunk_001, etc. in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 will capture the full chunking logic. No compression tool invocation — this tests the file-creation-based detection branch.
- Test 4Rclone file exfiltration with chunk size limit
Expected signal: Sysmon Event ID 1 (Process Create): Image=rclone.exe (or full path), CommandLine containing 'copy', '--max-size', '--transfers'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 3 (Network Connection) would fire if targeting a real remote — absent here due to local target. If rclone is not present the test exits gracefully with a message.
References (12)
- https://attack.mitre.org/techniques/T1030/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
- https://www.trendmicro.com/en_us/research/23/g/play-ransomware-spotlight.html
- https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-stealer-and-a-possible-china-nexus-link/
- https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/
- https://www.mandiant.com/resources/blog/poshspy-backdoor-powershell
- https://www.welivesecurity.com/2018/12/05/forssh-kessel-run-ssh-botnet/
- https://unit42.paloaltonetworks.com/rdat-new-oilrig-backdoor/
- https://rclone.org/chunker/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
- https://www.cybereason.com/blog/research/threat-analysis-report-stealbit-the-custom-exfiltration-tool-of-lockbit
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
Unlock Pro Content
Get the full detection package for T1030 including response playbook, investigation guide, and atomic red team tests.