Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion.
Upgrade to ProDetect Archive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting in Google Chronicle
Most corporate DLP appliances and egress proxies alert on a single transfer or an aggregate daily transfer that crosses a configured size threshold (commonly 10MB, 25MB, or 50MB per-connection triggers, or a daily-total cap on a per-user or per-host basis). Adversaries who know or can infer these thresholds deliberately keep every individual transfer just under the trigger point by splitting collected data into fixed-size archive volumes before exfiltration — APT28 has been observed constraining exfil chunks to stay under configured DLP alert sizes during Ukraine-focused intrusions, LuminousMoth caps individual uploads at roughly 5MB when exfiltrating over Google Drive, Threat Group-3390 (Emissary Panda/APT27) has used volume-split RAR/7-Zip archives ahead of staged transfers, and Play ransomware affiliates split staged loot into uniform archive parts before the double-extortion exfil phase that precedes encryption. Because none of these chunks individually crosses a size-based alert threshold, and because the transfers are frequently spread across a sustained window rather than sent as a single burst, this technique defeats naive 'alert on large transfer' DLP rules that do not aggregate related connections by destination or by process. Detection therefore has to correlate two signals a single-transfer DLP rule cannot see on its own: (1) command-line or file-system evidence that data was deliberately split into equal-sized volumes immediately before egress, and (2) a burst of multiple outbound transfers to the same external destination whose sizes cluster tightly around a value just below a known DLP/proxy threshold rather than exhibiting the size variability of normal user traffic.
MITRE ATT&CK
- Tactic
- Exfiltration
YARA-L Detection Query
rule dlp_threshold_evasion_archive_split {
meta:
author = "Argus Detection Engineering"
description = "Detects archive volume-splitting tool invocations that are the process-side precursor to DLP/network size-threshold evasion exfiltration."
mitre_attack_tactic = "Exfiltration"
mitre_attack_technique = "T1030"
mitre_attack_url = "https://attack.mitre.org/techniques/T1030/"
severity = "HIGH"
priority = "HIGH"
version = "1.0"
created = "2026-07-21"
platforms = "Windows"
events:
$proc.metadata.event_type = "PROCESS_LAUNCH"
re.regex($proc.target.process.file.full_path, `(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe)`)
re.regex($proc.target.process.command_line, `(?i)(\s-v[\s0-9]|\s/v[\s0-9]|-volume)`)
$proc.principal.hostname = $hostname
match:
$hostname over 24h
outcome:
$risk_score = 70
$signal_type = "ArchiveVolumeSplitDLPEvasionCandidate"
condition:
$proc
}Chronicle YARA-L 2.0 rule matching PROCESS_LAUNCH UDM events for archive-splitting tool invocations (7-Zip/WinRAR volume flags), flagged as a DLP-threshold-evasion candidate. Intended to be paired with a Chronicle network-side rule or dashboard bucketing outbound NETWORK_CONNECTION bytes-sent values against the organization's configured DLP thresholds to complete the correlation demonstrated in the KQL/SPL detections.
Data Sources
Required Tables
False Positives & Tuning
- Backup software chunking uploads at a fixed size close to but under a proxy or API limit
- Cloud storage sync clients using fixed multipart upload block sizes
- CI/CD artifact upload tooling with a fixed chunk size
Other platforms for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Split archive into DLP-threshold-adjacent volumes and upload each below a monitored size
Expected signal: Sysmon Event ID 1 for 7z.exe with CommandLine containing '-v9646899b'. Sysmon Event ID 11 for the .7z.001 through .7z.004 chunk files. Sysmon Event ID 3 / proxy logs for 4 outbound POST connections to the test endpoint with near-identical byte counts just under 10MB.
- Test 2Unix split-based chunking with repeated near-threshold curl uploads
Expected signal: Linux auditd/Sysmon-for-Linux process events for split with '-b 24117145'. File creation events for argus_dlp_chunk_00 through argus_dlp_chunk_04. Network connection events for repeated curl POST requests with near-identical payload sizes just under 25MB to the same destination.
- Test 3WinRAR volume-split with delayed, spread-out uploads to avoid burst-based detection
Expected signal: Sysmon Event ID 1 for WinRAR.exe with '-v48234291b'. Sysmon Event ID 11 for the .part1.rar through .part4.rar files. Proxy/network logs showing 4 uploads near the 50MB threshold spread across roughly 90 seconds rather than a tight burst.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.