Linux split Utility Used to Divide Files Into Chunks (auditd SYSCALL)

Identifies use of the Linux split command to break files into parts, potentially for staging or exfiltration.

FreeUnreviewedSigmalowv1

linux-split-utility-used-to-divide-files-into-chunks-auditd-syscall-2dad0cba

title: Linux split Utility Used to Divide Files Into Chunks (auditd SYSCALL)
id: a38d5dbf-33a8-420f-a2ad-51e95b3ea939
status: test
description: This rule flags executions of the Linux "split" command observed via auditd syscall telemetry. Splitting a file into smaller pieces can help attackers prepare data for staging or transfer by bypassing size constraints or improving handling. The detection relies on matching the process name (comm) to "split" in Linux auditd syscall logs.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-28
tags:
  - attack.exfiltration
  - attack.t1030
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    comm: split
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: low
license: DRL-1.1
related:
  - id: 2dad0cba-c62a-4a4f-949f-5f6ecd619769
    type: derived

What it detects

This rule flags executions of the Linux "split" command observed via auditd syscall telemetry. Splitting a file into smaller pieces can help attackers prepare data for staging or transfer by bypassing size constraints or improving handling. The detection relies on matching the process name (comm) to "split" in Linux auditd syscall logs.

Known false positives

Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.