Detection of macOS Data Chunking Activities

Attackers targeting macOS systems often attempt to exfiltrate sensitive data while evading size-based security controls or network inspection triggers. A common technique involves the use of native system utilities, such as 'split' or 'dd', to break large files into smaller, more manageable chunks. This behavior allows attackers to bypass security appliances or detection rules that alert on large data transfers. This activity is often associated with the post-exploitation phase where an attacker seeks to move proprietary information outside the organization's network perimeter. Security teams should monitor for the execution of these commands, particularly when initiated from non-standard directories or by unauthorized users, as this is a precursor to successful data exfiltration.

Impact

Successful data chunking and subsequent exfiltration can lead to the unauthorized transfer of sensitive intellectual property, personally identifiable information, or credentials. If attackers bypass size-based network egress filters, they can systematically move data out of the environment without generating high-volume traffic alerts, potentially leading to long-term data loss or compliance breaches.

Recommendation

Deploy the provided Sigma detection rule to your SIEM and configure log aggregation for process execution data via osquery on macOS endpoints. Evaluate existing administrative workflows to identify and filter benign usage of 'split' and 'dd' to minimize false positives.

• Enable process auditing on macOS via endpoint security APIs and osquery to populate the required telemetry fields.
• Tune the detection logic by incorporating an allowlist for known administrative or backup scripts.