Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion.
Upgrade to ProDetect Chunked & Throttled Data Transfer to Evade DLP/Proxy Size-Threshold Detection in Sumo Logic CSE
Many DLP and web-proxy platforms only inspect or alert on a single transaction/session once its size crosses a configured ceiling (e.g. 10MB, 25MB, 50MB, 100MB) or once a per-user daily transfer volume is exceeded. Adversaries who are aware of these ceilings deliberately size their exfiltration to stay just underneath them rather than attempting a single large transfer that would trip the control. This shows up in two complementary behaviors: (1) archive splitting, where a staged collection of stolen data is compressed into equal-sized sub-threshold volumes using 7-Zip's -v flag, WinRAR's split-volume switch, Rclone's chunker overlay, or a raw `split -b`, producing sequentially numbered parts (.7z.001/.002, .partN.rar, .r00/.r01); and (2) session/day throttling, where the exfiltration channel itself (a C2 implant, a legitimate cloud-sync client abused for the transfer, or a scripted uploader) caps each individual upload's byte count and paces the uploads across many sessions in a day so that both the per-transaction proxy/DLP threshold and any daily aggregate quota are never technically breached, even though the cumulative volume moved over 24 hours can be very large. The two behaviors are frequently combined: a chunked archive's numbered parts are uploaded one at a time, each part sized just under the proxy's inspection ceiling, spread across a day to avoid burst-based rate alarms. Because each individual event looks unremarkable in isolation, this technique is best detected by aggregation — looking for repeated sessions from the same user/host to the same destination whose sent-byte counts cluster just below a round-number threshold, and by correlating that pattern with local filesystem evidence of split-archive staging.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
_sourceCategory="network/proxy" OR _sourceCategory="network/firewall"
| where bytes_sent > 1048576
| where (bytes_sent >= 8388608 AND bytes_sent <= 10485760) OR (bytes_sent >= 20971520 AND bytes_sent <= 26214400) OR (bytes_sent >= 41943040 AND bytes_sent <= 52428800) OR (bytes_sent >= 83886080 AND bytes_sent <= 104857600)
| timeslice 1d
| count AS SessionCount, sum(bytes_sent) AS TotalBytesSent, max(bytes_sent) AS MaxBytesSent BY src_user, dest_host, _timeslice
| where SessionCount >= 6
| eval Signal = if(TotalBytesSent > 524288000, "HighVolumeLowAndSlowExfil", "SubThresholdProxyBurst")
| eval RiskScore = if(Signal = "HighVolumeLowAndSlowExfil", 92, 75)
| sort by RiskScore descSumo Logic search over proxy/firewall log categories that buckets outbound sessions per user/destination/day, retains only those whose sent-byte counts land in the 80-100% band of a common round-number DLP threshold, and flags user/destination pairs with 6 or more such sessions in a day, escalating to HighVolumeLowAndSlowExfil when the cumulative daily volume exceeds 500MB.
Data Sources
Required Tables
False Positives & Tuning
- Backup jobs producing regular size-capped session bursts to a known offsite IP — maintain a Sumo Logic lookup table of authorized backup destinations and exclude matches
- Cloud-sync clients whose chunked-upload protocol produces a similar many-similar-size-sessions pattern to an approved destination
Other platforms for THREAT-Exfil-ChunkedSizeLimitEvasion
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Split-Archive Staging
Expected signal: Sysmon Event ID 1 for 7z.exe launched with a -v9m volume-size flag; Sysmon Event ID 11 for the creation of stage_archive.7z.001, .002, .003, etc. within a short window.
- Test 2Simulate Sub-Threshold Proxy Session Burst
Expected signal: Proxy/firewall log entries (CommonSecurityLog or pan:traffic) showing 8 outbound sessions to the test endpoint, each with SentBytes in the 8.5-9.5MB range, spread across roughly 40 minutes.
- Test 3Simulate High-Volume Low-and-Slow Exfil Escalation
Expected signal: 60 proxy/firewall session log entries to the test endpoint, each SentBytes in the 8.5-9.5MB range, summing to roughly 540MB over the test run.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfil-ChunkedSizeLimitEvasion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-Exfil-ArchiveSplitDLPThresholdEvasionArchive Volume-Splitting and Fixed-Chunk Transfers to Evade DLP/Network Size-Threshold Alerting
- THREAT-Exfiltration-UniformSizeBeaconChunkingUniform-Size Repeated Connections (Fixed-Size Chunk/Beacon Padding)Use for network-side detection — a statistical flow-volume pivot on uniform outbound transfer sizes, complementary to the file/process-based chunking signals in the base T1030 detection.