Detectionlowtest

Split A File Into Pieces

Detection use of the command "split" to split files into parts and possible transfer.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Igor Fits, Mikhail Larin, oscd.communityCreated Thu Oct 15Updated Sat Nov 277f2bb9d5-6395-4de5-969c-70c11fbe6b12macos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/split'
    condition: selection

False Positives

Legitimate administrative activity

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

7f2bb9d5-6395-4de5-969c-70c11fbe6b12

Status

test

Level

low

Type

Detection

Created

Thu Oct 15

Modified

Sat Nov 27

Author

Path

rules/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml

Raw Tags

attack.exfiltrationattack.t1030