Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion.
Upgrade to ProDetect Chunked & Throttled Data Transfer to Evade DLP/Proxy Size-Threshold Detection in Elastic Security
Many DLP and web-proxy platforms only inspect or alert on a single transaction/session once its size crosses a configured ceiling (e.g. 10MB, 25MB, 50MB, 100MB) or once a per-user daily transfer volume is exceeded. Adversaries who are aware of these ceilings deliberately size their exfiltration to stay just underneath them rather than attempting a single large transfer that would trip the control. This shows up in two complementary behaviors: (1) archive splitting, where a staged collection of stolen data is compressed into equal-sized sub-threshold volumes using 7-Zip's -v flag, WinRAR's split-volume switch, Rclone's chunker overlay, or a raw `split -b`, producing sequentially numbered parts (.7z.001/.002, .partN.rar, .r00/.r01); and (2) session/day throttling, where the exfiltration channel itself (a C2 implant, a legitimate cloud-sync client abused for the transfer, or a scripted uploader) caps each individual upload's byte count and paces the uploads across many sessions in a day so that both the per-transaction proxy/DLP threshold and any daily aggregate quota are never technically breached, even though the cumulative volume moved over 24 hours can be very large. The two behaviors are frequently combined: a chunked archive's numbered parts are uploaded one at a time, each part sized just under the proxy's inspection ceiling, spread across a day to avoid burst-based rate alarms. Because each individual event looks unremarkable in isolation, this technique is best detected by aggregation — looking for repeated sessions from the same user/host to the same destination whose sent-byte counts cluster just below a round-number threshold, and by correlating that pattern with local filesystem evidence of split-archive staging.
MITRE ATT&CK
- Tactic
- Exfiltration
Elastic Detection Query
sequence by host.name, user.name with maxspan=1d
[file where event.type == "creation" and
(file.name : "*.7z.0*" or file.name : "*.zip.0*" or file.name : "*.rar.0*" or file.name : "*.part1*" or file.name : "*.r00")
]
[network where event.type == "connection" and
network.direction == "outbound" and
destination.bytes >= 8388608 and destination.bytes <= 10485760
]Elastic EQL sequence correlating a locally-created archive chunk file with a subsequent outbound network connection whose transferred byte count lands in the 80-100% band just under a 10MB threshold, within the same day for the same host/user — the combined filesystem-plus-network fingerprint of chunked, size-throttled exfiltration.
Data Sources
Required Tables
False Positives & Tuning
- Cloud-sync or backup agents that both create local chunk files and upload them in matching sized sessions as part of a documented, approved workflow — allowlist the known agent's file.path and destination.ip
- CDN pre-staging or software distribution jobs uploading fixed-size installer parts to a known distribution endpoint
Other platforms for THREAT-Exfil-ChunkedSizeLimitEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Split-Archive Staging
Expected signal: Sysmon Event ID 1 for 7z.exe launched with a -v9m volume-size flag; Sysmon Event ID 11 for the creation of stage_archive.7z.001, .002, .003, etc. within a short window.
- Test 2Simulate Sub-Threshold Proxy Session Burst
Expected signal: Proxy/firewall log entries (CommonSecurityLog or pan:traffic) showing 8 outbound sessions to the test endpoint, each with SentBytes in the 8.5-9.5MB range, spread across roughly 40 minutes.
- Test 3Simulate High-Volume Low-and-Slow Exfil Escalation
Expected signal: 60 proxy/firewall session log entries to the test endpoint, each SentBytes in the 8.5-9.5MB range, summing to roughly 540MB over the test run.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Exfil-ArchiveSplitDLPThresholdEvasionArchive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting
- THREAT-Exfiltration-UniformSizeBeaconChunkingUniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding)Use for network-side detection — a statistical flow-volume pivot on uniform outbound transfer sizes, complementary to the file/process-based chunking signals in the base T1030 detection.