EXFIL Possible Data Exfiltration to Temporary File Sharing Service

Tim Peck@timpeck

•updated Nov 17, 2025•4•0•108

This rule detects outbound TLS connections to known temporary file sharing services, which can be indicative of data exfiltration. The rule inspects the Server Name Indication (SNI) field in TLS traffic for specific domain names associated with these services.