Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion.
Upgrade to ProDetect Archive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting in Microsoft Sentinel
Most corporate DLP appliances and egress proxies alert on a single transfer or an aggregate daily transfer that crosses a configured size threshold (commonly 10MB, 25MB, or 50MB per-connection triggers, or a daily-total cap on a per-user or per-host basis). Adversaries who know or can infer these thresholds deliberately keep every individual transfer just under the trigger point by splitting collected data into fixed-size archive volumes before exfiltration — APT28 has been observed constraining exfil chunks to stay under configured DLP alert sizes during Ukraine-focused intrusions, LuminousMoth caps individual uploads at roughly 5MB when exfiltrating over Google Drive, Threat Group-3390 (Emissary Panda/APT27) has used volume-split RAR/7-Zip archives ahead of staged transfers, and Play ransomware affiliates split staged loot into uniform archive parts before the double-extortion exfil phase that precedes encryption. Because none of these chunks individually crosses a size-based alert threshold, and because the transfers are frequently spread across a sustained window rather than sent as a single burst, this technique defeats naive 'alert on large transfer' DLP rules that do not aggregate related connections by destination or by process. Detection therefore has to correlate two signals a single-transfer DLP rule cannot see on its own: (1) command-line or file-system evidence that data was deliberately split into equal-sized volumes immediately before egress, and (2) a burst of multiple outbound transfers to the same external destination whose sizes cluster tightly around a value just below a known DLP/proxy threshold rather than exhibiting the size variability of normal user traffic.
MITRE ATT&CK
- Tactic
- Exfiltration
KQL Detection Query
let DLPThresholds = dynamic([10485760, 26214400, 52428800]); // 10MB, 25MB, 50MB — common DLP/proxy per-connection alert thresholds
let MarginPct = 0.08; // chunk sizes within 8% below a threshold are treated as deliberately capped
let SplitProcessEvents =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe")
or (FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh") and ProcessCommandLine has_any ("split -b", "split -n", "--bytes"))
| where ProcessCommandLine has_any (" -v", "/v", "-volume", "split -b", "split -n", "--bytes")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let ThresholdCappedTransfers =
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| where SentBytes > 1048576 // ignore trivial keep-alives below 1MB
| extend NearestThreshold = arg_min(abs(SentBytes - toscalar(DLPThresholds)), SentBytes) // placeholder for readability; real evaluation below
| mv-apply Threshold = DLPThresholds to typeof(long) on (
where SentBytes < Threshold and SentBytes > Threshold * (1 - MarginPct)
| extend MatchedThreshold = Threshold
)
| summarize
TransferCount = count(),
MinSent = min(SentBytes),
MaxSent = max(SentBytes),
MatchedThresholds = make_set(MatchedThreshold),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by DeviceName, InitiatingProcessFileName, RemoteIP
| where TransferCount >= 4
| extend SizeSpreadRatio = todouble(MaxSent - MinSent) / todouble(MaxSent)
| where SizeSpreadRatio < 0.10 // tightly clustered chunk sizes, not natural traffic variance
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, RemoteIP, TransferCount, MinSent, MaxSent, MatchedThresholds, SizeSpreadRatio;
SplitProcessEvents
| join kind=inner (ThresholdCappedTransfers) on DeviceName
| where LastSeen >= Timestamp // network activity followed the splitting command
| project SplitTimestamp = Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
TransferFirstSeen = FirstSeen, TransferLastSeen = LastSeen, RemoteIP, TransferCount, MinSent, MaxSent, MatchedThresholds
| sort by SplitTimestamp descCorrelates two signals to catch deliberate threshold-evasion exfil that a single-transfer DLP rule misses: (1) DeviceProcessEvents for archive-splitting tool invocations (7-Zip/WinRAR volume flags, Unix split), and (2) DeviceNetworkEvents grouped by destination host+process where 4 or more outbound transfers land within 8% below a known DLP threshold value (10MB/25MB/50MB) and cluster tightly in size (spread ratio under 10%). Requiring the network burst to follow the splitting command on the same device links the archive-creation evidence to the actual egress.
Data Sources
Required Tables
False Positives & Tuning
- Backup or replication software configured with a fixed transfer chunk size close to but under a proxy MTU or upload-API limit for unrelated reasons
- Cloud storage clients (OneDrive, Dropbox, Google Drive sync agents) that internally chunk large file uploads at fixed API-imposed block sizes
- CDN or artifact-repository upload tooling in CI/CD pipelines that chunks build artifacts at a fixed size for parallel multipart upload
- Video conferencing or streaming software whose segment sizes happen to cluster near one of the monitored threshold values
Other platforms for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Split archive into DLP-threshold-adjacent volumes and upload each below a monitored size
Expected signal: Sysmon Event ID 1 for 7z.exe with CommandLine containing '-v9646899b'. Sysmon Event ID 11 for the .7z.001 through .7z.004 chunk files. Sysmon Event ID 3 / proxy logs for 4 outbound POST connections to the test endpoint with near-identical byte counts just under 10MB.
- Test 2Unix split-based chunking with repeated near-threshold curl uploads
Expected signal: Linux auditd/Sysmon-for-Linux process events for split with '-b 24117145'. File creation events for argus_dlp_chunk_00 through argus_dlp_chunk_04. Network connection events for repeated curl POST requests with near-identical payload sizes just under 25MB to the same destination.
- Test 3WinRAR volume-split with delayed, spread-out uploads to avoid burst-based detection
Expected signal: Sysmon Event ID 1 for WinRAR.exe with '-v48234291b'. Sysmon Event ID 11 for the .part1.rar through .part4.rar files. Proxy/network logs showing 4 uploads near the 50MB threshold spread across roughly 90 seconds rather than a tight burst.
References (4)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ArchiveSplitDLPThresholdEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.