Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion.
Upgrade to ProDetect Chunked & Throttled Data Transfer to Evade DLP/Proxy Size-Threshold Detection in Splunk
Many DLP and web-proxy platforms only inspect or alert on a single transaction/session once its size crosses a configured ceiling (e.g. 10MB, 25MB, 50MB, 100MB) or once a per-user daily transfer volume is exceeded. Adversaries who are aware of these ceilings deliberately size their exfiltration to stay just underneath them rather than attempting a single large transfer that would trip the control. This shows up in two complementary behaviors: (1) archive splitting, where a staged collection of stolen data is compressed into equal-sized sub-threshold volumes using 7-Zip's -v flag, WinRAR's split-volume switch, Rclone's chunker overlay, or a raw `split -b`, producing sequentially numbered parts (.7z.001/.002, .partN.rar, .r00/.r01); and (2) session/day throttling, where the exfiltration channel itself (a C2 implant, a legitimate cloud-sync client abused for the transfer, or a scripted uploader) caps each individual upload's byte count and paces the uploads across many sessions in a day so that both the per-transaction proxy/DLP threshold and any daily aggregate quota are never technically breached, even though the cumulative volume moved over 24 hours can be very large. The two behaviors are frequently combined: a chunked archive's numbered parts are uploaded one at a time, each part sized just under the proxy's inspection ceiling, spread across a day to avoid burst-based rate alarms. Because each individual event looks unremarkable in isolation, this technique is best detected by aggregation — looking for repeated sessions from the same user/host to the same destination whose sent-byte counts cluster just below a round-number threshold, and by correlating that pattern with local filesystem evidence of split-archive staging.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
index=proxy sourcetype="pan:traffic" bytes_sent>1048576 NOT dest_ip="10.0.0.0/8" NOT dest_ip="172.16.0.0/12" NOT dest_ip="192.168.0.0/16"
| eval NearestThresholdMB=case(
bytes_sent>=8388608 AND bytes_sent<=10485760, 10,
bytes_sent>=20971520 AND bytes_sent<=26214400, 25,
bytes_sent>=41943040 AND bytes_sent<=52428800, 50,
bytes_sent>=83886080 AND bytes_sent<=104857600, 100,
bytes_sent>=209715200 AND bytes_sent<=262144000, 250,
true(), 0)
| where NearestThresholdMB>0
| bin _time span=1d
| stats count AS SessionCount, sum(bytes_sent) AS TotalBytesSent, max(bytes_sent) AS MaxBytesSent BY src_user, dest, NearestThresholdMB, _time
| where SessionCount>=6
| eval Signal=if(TotalBytesSent>524288000, "HighVolumeLowAndSlowExfil", "SubThresholdProxyBurst")
| eval RiskScore=if(Signal=="HighVolumeLowAndSlowExfil", 92, 75)
| table _time src_user dest NearestThresholdMB SessionCount TotalBytesSent MaxBytesSent Signal RiskScore
| append
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.7z.0*" OR TargetFilename="*.zip.0*" OR TargetFilename="*.rar.0*" OR TargetFilename="*.part1*" OR TargetFilename="*.r00")
| bin _time span=15m
| stats count AS SessionCount, values(TargetFilename) AS Files BY host, User, Image, _time
| where SessionCount>=4
| eval Signal="ChunkedArchiveStaging", RiskScore=55, dest="(local staging)", src_user=User
| table _time src_user dest Files SessionCount Signal RiskScore ]
| sort - RiskScore -_timeSPL detection combining a proxy/firewall search (Palo Alto pan:traffic sourcetype, adjust for your proxy vendor) that buckets outbound sessions per user/destination/day and flags those whose sent-byte counts repeatedly land just under a round-number DLP threshold, with an appended Sysmon Event ID 11 search for bursts of 4+ sequentially-numbered archive chunk files created locally within 15 minutes — the filesystem-side evidence of deliberate volume splitting.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Backup/replication software pacing uploads to an offsite target in size-capped increments during a scheduled maintenance window
- Cloud-sync clients (OneDrive, Google Drive, Dropbox) that natively chunk large uploads as part of a resumable-upload protocol
- Contracted ETL/data-export jobs that intentionally rate-limit egress bandwidth to a partner or analytics vendor
Other platforms for THREAT-Exfil-ChunkedSizeLimitEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Split-Archive Staging
Expected signal: Sysmon Event ID 1 for 7z.exe launched with a -v9m volume-size flag; Sysmon Event ID 11 for the creation of stage_archive.7z.001, .002, .003, etc. within a short window.
- Test 2Simulate Sub-Threshold Proxy Session Burst
Expected signal: Proxy/firewall log entries (CommonSecurityLog or pan:traffic) showing 8 outbound sessions to the test endpoint, each with SentBytes in the 8.5-9.5MB range, spread across roughly 40 minutes.
- Test 3Simulate High-Volume Low-and-Slow Exfil Escalation
Expected signal: 60 proxy/firewall session log entries to the test endpoint, each SentBytes in the 8.5-9.5MB range, summing to roughly 540MB over the test run.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Exfil-ArchiveSplitDLPThresholdEvasionArchive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting
- THREAT-Exfiltration-UniformSizeBeaconChunkingUniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding)Use for network-side detection — a statistical flow-volume pivot on uniform outbound transfer sizes, complementary to the file/process-based chunking signals in the base T1030 detection.