Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion.
Upgrade to ProDetect Archive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting in CrowdStrike LogScale
Most corporate DLP appliances and egress proxies alert on a single transfer or an aggregate daily transfer that crosses a configured size threshold (commonly 10MB, 25MB, or 50MB per-connection triggers, or a daily-total cap on a per-user or per-host basis). Adversaries who know or can infer these thresholds deliberately keep every individual transfer just under the trigger point by splitting collected data into fixed-size archive volumes before exfiltration — APT28 has been observed constraining exfil chunks to stay under configured DLP alert sizes during Ukraine-focused intrusions, LuminousMoth caps individual uploads at roughly 5MB when exfiltrating over Google Drive, Threat Group-3390 (Emissary Panda/APT27) has used volume-split RAR/7-Zip archives ahead of staged transfers, and Play ransomware affiliates split staged loot into uniform archive parts before the double-extortion exfil phase that precedes encryption. Because none of these chunks individually crosses a size-based alert threshold, and because the transfers are frequently spread across a sustained window rather than sent as a single burst, this technique defeats naive 'alert on large transfer' DLP rules that do not aggregate related connections by destination or by process. Detection therefore has to correlate two signals a single-transfer DLP rule cannot see on its own: (1) command-line or file-system evidence that data was deliberately split into equal-sized volumes immediately before egress, and (2) a burst of multiple outbound transfers to the same external destination whose sizes cluster tightly around a value just below a known DLP/proxy threshold rather than exhibiting the size variability of normal user traffic.
MITRE ATT&CK
- Tactic
- Exfiltration
LogScale Detection Query
// Part 1: archive-splitting process events
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe)/
| CommandLine = /(?i)(\s-v[\s0-9]|\s\/v[\s0-9]|-volume)/
| table([_timeutc, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])
// ----
// Part 2: clustered near-threshold outbound transfers (Falcon network telemetry)
// Run as separate query and correlate by ComputerName
#event_simpleName=NetworkConnectIP4
| BytesSent > 1048576
| groupBy([ComputerName, RemoteAddressIP4], function=[count(as=TransferCount), min(BytesSent, as=MinSent), max(BytesSent, as=MaxSent)])
| TransferCount >= 4
| SizeSpreadRatio := (MaxSent - MinSent) / MaxSent
| SizeSpreadRatio < 0.10CrowdStrike LogScale query for the archive-splitting process signal via ProcessRollup2, with a companion query aggregating NetworkConnectIP4 events by host/destination to surface clustered near-threshold transfer bursts (4+ connections, size spread under 10%) — combine both in a LogScale dashboard or scheduled search correlated on ComputerName to reproduce the full KQL/SPL join logic.
Data Sources
Required Tables
False Positives & Tuning
- Backup software chunking uploads at a fixed size close to but under a proxy or API limit
- Cloud storage sync clients using fixed multipart upload block sizes
- CI/CD artifact upload tooling with a fixed chunk size
Other platforms for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Split archive into DLP-threshold-adjacent volumes and upload each below a monitored size
Expected signal: Sysmon Event ID 1 for 7z.exe with CommandLine containing '-v9646899b'. Sysmon Event ID 11 for the .7z.001 through .7z.004 chunk files. Sysmon Event ID 3 / proxy logs for 4 outbound POST connections to the test endpoint with near-identical byte counts just under 10MB.
- Test 2Unix split-based chunking with repeated near-threshold curl uploads
Expected signal: Linux auditd/Sysmon-for-Linux process events for split with '-b 24117145'. File creation events for argus_dlp_chunk_00 through argus_dlp_chunk_04. Network connection events for repeated curl POST requests with near-identical payload sizes just under 25MB to the same destination.
- Test 3WinRAR volume-split with delayed, spread-out uploads to avoid burst-based detection
Expected signal: Sysmon Event ID 1 for WinRAR.exe with '-v48234291b'. Sysmon Event ID 11 for the .part1.rar through .part4.rar files. Proxy/network logs showing 4 uploads near the 50MB threshold spread across roughly 90 seconds rather than a tight burst.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.