macOS split Command Used to Divide Files into Parts
Flags macOS process execution of split, indicating file splitting activity that may support staging or exfiltration.
FreeReviewedSigma · Low · v2
- Product
- macos
- Category
- process_creation
- Author
- Igor Fits, Mikhail Larin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-15
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the macOS 'split' utility by matching the process image path ending in '/split'. Attackers may use file-splitting to break large or sensitive data into smaller chunks to facilitate staging or later transfer. Telemetry relies on process creation events that include the executed image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
macos-process-creation-of-split-used-to-divide-files-into-pieces-7f2bb9d5
title: macOS split Command Used to Divide Files into Parts
id: 491a542f-491f-470b-8501-27dc0b2beb8a
status: test
description: This rule flags execution of the macOS 'split' utility by matching the process image path ending in '/split'. Attackers may use file-splitting to break large or sensitive data into smaller chunks to facilitate staging or later transfer. Telemetry relies on process creation events that include the executed image path.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml
author: Igor Fits, Mikhail Larin, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2021-11-27
tags:
- attack.exfiltration
- attack.t1030
logsource:
product: macos
category: process_creation
detection:
selection:
Image|endswith: /split
condition: selection
falsepositives:
- Legitimate administrative activity
level: low
license: DRL-1.1
related:
- id: 7f2bb9d5-6395-4de5-969c-70c11fbe6b12
type: derived