Detectionlowtest

Split A File Into Pieces - Linux

Detection use of the command "split" to split files into parts and possible transfer.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Igor Fits, oscd.communityCreated Thu Oct 15Updated Mon Nov 282dad0cba-c62a-4a4f-949f-5f6ecd619769linux

Log Source

Linuxauditd

ProductLinux← raw: linux

Serviceauditd← raw: auditd

Detection Logic

detection:
    selection:
        type: 'SYSCALL'
        comm: 'split'
    condition: selection

False Positives

Legitimate administrative activity

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

2dad0cba-c62a-4a4f-949f-5f6ecd619769

Status

test

Level

low

Type

Detection

Created

Thu Oct 15

Modified

Mon Nov 28

Author

Path

rules/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml

Raw Tags

attack.exfiltrationattack.t1030