Linux Auditd Data Transfer Size Limits Via Split Command

This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.