macOS: Process creation of split used to divide files into pieces

Flags macOS process execution of split, indicating file splitting activity that may support staging or exfiltration.

FreeUnreviewedSigmalowv1

macos-process-creation-of-split-used-to-divide-files-into-pieces-7f2bb9d5

title: "macOS: Process creation of split used to divide files into pieces"
id: 491a542f-491f-470b-8501-27dc0b2beb8a
status: test
description: This rule matches process creation events where the executable path ends with '/split', indicating use of the split utility to divide a file into smaller parts. Attackers may use split to break up data to simplify handling, transport, or later reassembly during exfiltration or staging. It relies on macOS process creation telemetry capturing the executed command path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2021-11-27
tags:
  - attack.exfiltration
  - attack.t1030
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /split
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: low
license: DRL-1.1
related:
  - id: 7f2bb9d5-6395-4de5-969c-70c11fbe6b12
    type: derived

What it detects

This rule matches process creation events where the executable path ends with '/split', indicating use of the split utility to divide a file into smaller parts. Attackers may use split to break up data to simplify handling, transport, or later reassembly during exfiltration or staging. It relies on macOS process creation telemetry capturing the executed command path.

Known false positives

Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.