Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion.
Upgrade to ProDetect Chunked & Throttled Data Transfer to Evade DLP/Proxy Size-Threshold Detection in CrowdStrike LogScale
Many DLP and web-proxy platforms only inspect or alert on a single transaction/session once its size crosses a configured ceiling (e.g. 10MB, 25MB, 50MB, 100MB) or once a per-user daily transfer volume is exceeded. Adversaries who are aware of these ceilings deliberately size their exfiltration to stay just underneath them rather than attempting a single large transfer that would trip the control. This shows up in two complementary behaviors: (1) archive splitting, where a staged collection of stolen data is compressed into equal-sized sub-threshold volumes using 7-Zip's -v flag, WinRAR's split-volume switch, Rclone's chunker overlay, or a raw `split -b`, producing sequentially numbered parts (.7z.001/.002, .partN.rar, .r00/.r01); and (2) session/day throttling, where the exfiltration channel itself (a C2 implant, a legitimate cloud-sync client abused for the transfer, or a scripted uploader) caps each individual upload's byte count and paces the uploads across many sessions in a day so that both the per-transaction proxy/DLP threshold and any daily aggregate quota are never technically breached, even though the cumulative volume moved over 24 hours can be very large. The two behaviors are frequently combined: a chunked archive's numbered parts are uploaded one at a time, each part sized just under the proxy's inspection ceiling, spread across a day to avoid burst-based rate alarms. Because each individual event looks unremarkable in isolation, this technique is best detected by aggregation — looking for repeated sessions from the same user/host to the same destination whose sent-byte counts cluster just below a round-number threshold, and by correlating that pattern with local filesystem evidence of split-archive staging.
MITRE ATT&CK
- Tactic
- Exfiltration
LogScale Detection Query
#event_simpleName=NetworkConnectIP4
| BytesSent >= 8388608
| BytesSent <= 10485760
| RemoteIP != /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/
| Signal := "SubThresholdProxyBurst"
| groupBy([UserName, RemoteIP, ComputerName], function=[count(as=SessionCount), sum(field=BytesSent, as=TotalBytesSent), max(field=BytesSent, as=MaxBytesSent)])
| test(SessionCount >= 6)
| RiskScore := if(TotalBytesSent > 524288000, 92, 75)
| sort(field=RiskScore, order=desc)CrowdStrike LogScale (Falcon) detection query using NetworkConnectIP4 endpoint telemetry to identify hosts/users producing 6 or more outbound connections whose BytesSent value lands in the 80-100% band just under a 10MB threshold, aggregating SessionCount and TotalBytesSent per user/destination pair and escalating the risk score once the aggregate crosses 500MB. Duplicate with adjusted byte-range filters for the 25/50/100MB bands to cover additional common DLP ceilings.
Data Sources
Required Tables
False Positives & Tuning
- Approved backup/replication agents whose scheduled uploads consistently land in the same byte-size band -- use Falcon host groups to tag known backup infrastructure and exclude matching ComputerName/RemoteIP values
- Cloud-sync clients whose resumable-upload protocol produces fixed-size chunk uploads to an approved destination
Other platforms for THREAT-Exfil-ChunkedSizeLimitEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Split-Archive Staging
Expected signal: Sysmon Event ID 1 for 7z.exe launched with a -v9m volume-size flag; Sysmon Event ID 11 for the creation of stage_archive.7z.001, .002, .003, etc. within a short window.
- Test 2Simulate Sub-Threshold Proxy Session Burst
Expected signal: Proxy/firewall log entries (CommonSecurityLog or pan:traffic) showing 8 outbound sessions to the test endpoint, each with SentBytes in the 8.5-9.5MB range, spread across roughly 40 minutes.
- Test 3Simulate High-Volume Low-and-Slow Exfil Escalation
Expected signal: 60 proxy/firewall session log entries to the test endpoint, each SentBytes in the 8.5-9.5MB range, summing to roughly 540MB over the test run.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Exfil-ArchiveSplitDLPThresholdEvasionArchive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting
- THREAT-Exfiltration-UniformSizeBeaconChunkingUniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding)Use for network-side detection — a statistical flow-volume pivot on uniform outbound transfer sizes, complementary to the file/process-based chunking signals in the base T1030 detection.