Linux 'split' Command Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•28

This rule detects the execution of the 'split' command on Linux systems. The 'split' command is used to break a file into smaller pieces, which can be a technique used by adversaries to bypass data transfer size limits during exfiltration or to make files easier to transfer.