Identifier / Programs / Linux and Unix
split
Split a file into pieces. tldr-pages
GTFOBins file-read, file-write, shell 1 Sigma rule name it 2 ATT&CK techniques 3 documented commands
How split is abused
file-read
prefix
-bBYTES/file (10, 10k, 10m, 10g...) toybox--additional-suffixfile-write
prefix
-bBYTES/file (10, 10k, 10m, 10g...) toybox--additional-suffixEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for split.
3 documented commands
file-read unprivileged, with sudo, as SUID
This copies the input file in the current working directory in a file named prefixaasuffix, just make sure to pick a value big enough, instead of 999.
split -b 999 --additional-suffix suffix /path/to/input-file prefix
cat prefixaasuffixTrips 1 Sigma rule: lowSplit A File Into Pieces by Igor Fits, Mikhail Larin, oscd.community
file-write unprivileged, with sudo, as SUID
This copies the input file in the current working directory in a file named prefixaasuffix, just make sure to pick a value big enough, instead of 999.
split -b 999 --additional-suffix suffix /path/to/input-file prefixTrips 1 Sigma rule: lowSplit A File Into Pieces by Igor Fits, Mikhail Larin, oscd.community
shell unprivileged, with sudo, as SUID
split --filter='/bin/sh -i 0<&2 1>&2' /etc/hostsTrips 1 Sigma rule: lowSplit A File Into Pieces by Igor Fits, Mikhail Larin, oscd.community
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for split. The identifier reads the line of each that runs split.
What detects it
Everyday use
Split a file, each split having 10 lines (except the last split)
split --lines 10 path/to/fileIdentifyTrips 1 Sigma rule: lowSplit A File Into Pieces by Igor Fits, Mikhail Larin, oscd.community
Split a file into 5 files. File is split such that each split has same size (except the last split)
split --number 5 path/to/fileIdentifyTrips 1 Sigma rule: lowSplit A File Into Pieces by Igor Fits, Mikhail Larin, oscd.community
Split a file with 512 bytes in each split (except the last split; use 512k for kilobytes and 512m for megabytes)
split --bytes 512 path/to/fileIdentifyTrips 1 Sigma rule: lowSplit A File Into Pieces by Igor Fits, Mikhail Larin, oscd.community
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.
Options
Show every option of split
-a SUFFIX_LENSuffix length (default 2)-b BYTESBYTES/file (10, 10k, 10m, 10g...)-l LINESLINES/file (default 1000)-n PARTSPARTS many equal length files