Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion.
Upgrade to ProDetect Chunked & Throttled Data Transfer to Evade DLP/Proxy Size-Threshold Detection in IBM QRadar
Many DLP and web-proxy platforms only inspect or alert on a single transaction/session once its size crosses a configured ceiling (e.g. 10MB, 25MB, 50MB, 100MB) or once a per-user daily transfer volume is exceeded. Adversaries who are aware of these ceilings deliberately size their exfiltration to stay just underneath them rather than attempting a single large transfer that would trip the control. This shows up in two complementary behaviors: (1) archive splitting, where a staged collection of stolen data is compressed into equal-sized sub-threshold volumes using 7-Zip's -v flag, WinRAR's split-volume switch, Rclone's chunker overlay, or a raw `split -b`, producing sequentially numbered parts (.7z.001/.002, .partN.rar, .r00/.r01); and (2) session/day throttling, where the exfiltration channel itself (a C2 implant, a legitimate cloud-sync client abused for the transfer, or a scripted uploader) caps each individual upload's byte count and paces the uploads across many sessions in a day so that both the per-transaction proxy/DLP threshold and any daily aggregate quota are never technically breached, even though the cumulative volume moved over 24 hours can be very large. The two behaviors are frequently combined: a chunked archive's numbered parts are uploaded one at a time, each part sized just under the proxy's inspection ceiling, spread across a day to avoid burst-based rate alarms. Because each individual event looks unremarkable in isolation, this technique is best detected by aggregation — looking for repeated sessions from the same user/host to the same destination whose sent-byte counts cluster just below a round-number threshold, and by correlating that pattern with local filesystem evidence of split-archive staging.
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
sourceip AS SourceIP,
username AS User,
destinationip AS DestinationIP,
"Bytes Sent" AS BytesSent,
LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
'SubThresholdProxyBurst' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%proxy%' OR LOGSOURCETYPENAME(logsourceid) ILIKE '%firewall%'
AND "Bytes Sent" > 1048576
AND (
("Bytes Sent" BETWEEN 8388608 AND 10485760)
OR ("Bytes Sent" BETWEEN 20971520 AND 26214400)
OR ("Bytes Sent" BETWEEN 41943040 AND 52428800)
OR ("Bytes Sent" BETWEEN 83886080 AND 104857600)
)
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000QRadar AQL query surfacing proxy/firewall events in the last 24 hours whose Bytes Sent value lands within the 80-100% band of a common 10/25/50/100MB DLP inspection ceiling. Pair with an AQL GROUP BY sourceip, username, destinationip having COUNT(*) >= 6 (via a follow-on Custom Rule or saved search) to surface the repeated-burst pattern per user/destination pair.
Data Sources
Required Tables
False Positives & Tuning
- Backup/replication jobs generating regular size-capped sessions to a known offsite target during a maintenance window — populate a reference set of authorized backup destination IPs and service accounts to exclude
- Approved cloud-sync clients whose resumable-upload protocol natively produces fixed-size chunk uploads
Other platforms for THREAT-Exfil-ChunkedSizeLimitEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Split-Archive Staging
Expected signal: Sysmon Event ID 1 for 7z.exe launched with a -v9m volume-size flag; Sysmon Event ID 11 for the creation of stage_archive.7z.001, .002, .003, etc. within a short window.
- Test 2Simulate Sub-Threshold Proxy Session Burst
Expected signal: Proxy/firewall log entries (CommonSecurityLog or pan:traffic) showing 8 outbound sessions to the test endpoint, each with SentBytes in the 8.5-9.5MB range, spread across roughly 40 minutes.
- Test 3Simulate High-Volume Low-and-Slow Exfil Escalation
Expected signal: 60 proxy/firewall session log entries to the test endpoint, each SentBytes in the 8.5-9.5MB range, summing to roughly 540MB over the test run.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Exfil-ArchiveSplitDLPThresholdEvasionArchive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting
- THREAT-Exfiltration-UniformSizeBeaconChunkingUniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding)Use for network-side detection — a statistical flow-volume pivot on uniform outbound transfer sizes, complementary to the file/process-based chunking signals in the base T1030 detection.