Data Transfer Size Limits — Archive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting

let DLPThresholds = dynamic([10485760, 26214400, 52428800]); // 10MB, 25MB, 50MB — common DLP/proxy per-connection alert thresholds
let MarginPct = 0.08; // chunk sizes within 8% below a threshold are treated as deliberately capped
let SplitProcessEvents =
  DeviceProcessEvents
  | where Timestamp > ago(24h)
  | where FileName in~ ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe")
      or (FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh") and ProcessCommandLine has_any ("split -b", "split -n", "--bytes"))
  | where ProcessCommandLine has_any (" -v", "/v", "-volume", "split -b", "split -n", "--bytes")
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let ThresholdCappedTransfers =
  DeviceNetworkEvents
  | where Timestamp > ago(24h)
  | where ActionType == "ConnectionSuccess"
  | where RemoteIPType == "Public"
  | where SentBytes > 1048576 // ignore trivial keep-alives below 1MB
  | extend NearestThreshold = arg_min(abs(SentBytes - toscalar(DLPThresholds)), SentBytes) // placeholder for readability; real evaluation below
  | mv-apply Threshold = DLPThresholds to typeof(long) on (
      where SentBytes < Threshold and SentBytes > Threshold * (1 - MarginPct)
      | extend MatchedThreshold = Threshold
    )
  | summarize
      TransferCount = count(),
      MinSent = min(SentBytes),
      MaxSent = max(SentBytes),
      MatchedThresholds = make_set(MatchedThreshold),
      FirstSeen = min(Timestamp),
      LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, RemoteIP
  | where TransferCount >= 4
  | extend SizeSpreadRatio = todouble(MaxSent - MinSent) / todouble(MaxSent)
  | where SizeSpreadRatio < 0.10 // tightly clustered chunk sizes, not natural traffic variance
  | project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, RemoteIP, TransferCount, MinSent, MaxSent, MatchedThresholds, SizeSpreadRatio;
SplitProcessEvents
| join kind=inner (ThresholdCappedTransfers) on DeviceName
| where LastSeen >= Timestamp // network activity followed the splitting command
| project SplitTimestamp = Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    TransferFirstSeen = FirstSeen, TransferLastSeen = LastSeen, RemoteIP, TransferCount, MinSent, MaxSent, MatchedThresholds
| sort by SplitTimestamp desc

| join type=inner host
  [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
   (Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zr.exe" OR Image="*\\rar.exe" OR Image="*\\WinRAR.exe")
   (CommandLine="* -v*" OR CommandLine="* /v*" OR CommandLine="*-volume*")
  | rename _time as SplitTime
  | table SplitTime, host, User, Image, CommandLine]
  [search index=firewall OR index=proxy earliest=-24h
   NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*")
   bytes_out>1048576
  | eval ThresholdBucket=case(
      bytes_out<10485760 AND bytes_out>9646899, "10MB",
      bytes_out<26214400 AND bytes_out>24117145, "25MB",
      bytes_out<52428800 AND bytes_out>48234291, "50MB",
      1=1, null())
  | where isnotnull(ThresholdBucket)
  | stats count as TransferCount, min(bytes_out) as MinSent, max(bytes_out) as MaxSent,
          values(ThresholdBucket) as MatchedThresholds, earliest(_time) as TransferFirst, latest(_time) as TransferLast
      by host, dest_ip
  | where TransferCount>=4
  | eval SizeSpreadRatio=round((MaxSent-MinSent)/MaxSent, 3)
  | where SizeSpreadRatio<0.10]
| where TransferFirst>=SplitTime
| table SplitTime, host, User, Image, CommandLine, dest_ip, TransferCount, MinSent, MaxSent, MatchedThresholds, SizeSpreadRatio
| sort - SplitTime

sequence by host.id with maxspan=24h
  [process where event.type == "start"
    and process.name in~ ("7z", "7za", "7zr", "7z.exe", "7za.exe", "7zr.exe", "rar", "rar.exe", "winrar.exe")
    and process.command_line : ("* -v*", "* /v*", "*-volume*")
  ]
  [network where event.type == "connection" and network.direction == "outbound"
    and destination.ip != null
    and network.bytes > 1048576
  ]

-- Part 1: archive-splitting process events
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS SplitTime,
  "sourceip" AS HostIP,
  username,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine
FROM events
WHERE devicetime > NOW() - 86400000
  AND QIDNAME(qid) IN ('Process Creation', 'Windows Sysmon Process Created')
  AND (
    LOWER("Process Name") LIKE '%7z.exe' OR LOWER("Process Name") LIKE '%7za.exe'
    OR LOWER("Process Name") LIKE '%7zr.exe' OR LOWER("Process Name") LIKE '%rar.exe'
    OR LOWER("Process Name") LIKE '%winrar.exe'
  )
  AND ("Command" LIKE '% -v%' OR "Command" LIKE '% /v%' OR "Command" LIKE '%-volume%')
-- Part 2: clustered near-threshold transfers (run separately and correlate by sourceip/host in a rule or offense builder)
-- SELECT sourceip, destinationip, SUM("Bytes Sent") AS TotalSent, COUNT(*) AS TransferCount
-- FROM events WHERE devicetime > NOW() - 86400000 AND "Bytes Sent" > 1048576
-- GROUP BY sourceip, destinationip HAVING COUNT(*) >= 4
ORDER BY SplitTime DESC

// Part 1: archive-splitting process events
(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where EventID = "1" or EventCode = "1"
| where (Image matches "*\\7z.exe" or Image matches "*\\7za.exe" or Image matches "*\\7zr.exe"
         or Image matches "*\\rar.exe" or Image matches "*\\WinRAR.exe")
  and (CommandLine matches "* -v*" or CommandLine matches "* /v*" or CommandLine matches "*-volume*")
| fields _messageTime, Computer, User, Image, CommandLine

// Part 2 — run as separate query and correlate by host:
// _sourceCategory=*proxy* OR _sourceCategory=*firewall*
// | where bytes_out > 1048576
// | timeslice 24h
// | stats count as TransferCount, min(bytes_out) as MinSent, max(bytes_out) as MaxSent by _timeslice, host, dest_ip
// | where TransferCount >= 4
// | eval SizeSpreadRatio = (MaxSent - MinSent) / MaxSent
// | where SizeSpreadRatio < 0.10

rule dlp_threshold_evasion_archive_split {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects archive volume-splitting tool invocations that are the process-side precursor to DLP/network size-threshold evasion exfiltration."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1030"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1030/"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"
    created = "2026-07-21"
    platforms = "Windows"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($proc.target.process.file.full_path, `(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe)`)
    re.regex($proc.target.process.command_line, `(?i)(\s-v[\s0-9]|\s/v[\s0-9]|-volume)`)
    $proc.principal.hostname = $hostname

  match:
    $hostname over 24h

  outcome:
    $risk_score = 70
    $signal_type = "ArchiveVolumeSplitDLPEvasionCandidate"

  condition:
    $proc
}

// Part 1: archive-splitting process events
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe)/
| CommandLine = /(?i)(\s-v[\s0-9]|\s\/v[\s0-9]|-volume)/
| table([_timeutc, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])

// ----

// Part 2: clustered near-threshold outbound transfers (Falcon network telemetry)
// Run as separate query and correlate by ComputerName
#event_simpleName=NetworkConnectIP4
| BytesSent > 1048576
| groupBy([ComputerName, RemoteAddressIP4], function=[count(as=TransferCount), min(BytesSent, as=MinSent), max(BytesSent, as=MaxSent)])
| TransferCount >= 4
| SizeSpreadRatio := (MaxSent - MinSent) / MaxSent
| SizeSpreadRatio < 0.10