Linux split Command Used to Divide Files for Possible Exfiltration
Identifies use of the Linux split command to break files into parts, potentially for staging or exfiltration.
- Product
- linux
- Service
- auditd
- Author
- Igor Fits, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-15
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of the Linux command "split", which divides a file into multiple smaller parts. Attackers may use this to package data for easier handling, bypass constraints, or facilitate subsequent transfer/exfiltration. The detection relies on Linux auditd syscall telemetry capturing process name execution where comm equals "split".
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux split Command Used to Divide Files for Possible Exfiltration
id: a38d5dbf-33a8-420f-a2ad-51e95b3ea939
status: test
description: This rule identifies execution of the Linux command "split", which divides a file into multiple smaller parts. Attackers may use this to package data for easier handling, bypass constraints, or facilitate subsequent transfer/exfiltration. The detection relies on Linux auditd syscall telemetry capturing process name execution where comm equals "split".
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-28
tags:
- attack.exfiltration
- attack.t1030
logsource:
product: linux
service: auditd
detection:
selection:
type: SYSCALL
comm: split
condition: selection
falsepositives:
- Legitimate administrative activity
level: low
license: DRL-1.1
related:
- id: 2dad0cba-c62a-4a4f-949f-5f6ecd619769
type: derived