ATT&CK T1030 - Chunked Exfiltration: Many Small POSTs
This rule detects potential data exfiltration attempts characterized by a high volume of small HTTP POST requests from a single source IP address within a short timeframe. Specifically, it looks for 50 or more HTTP POST requests within 60 seconds, where each request has a body size between 101 and 1999 bytes. This pattern is indicative of 'chunked exfiltration' (ATT&CK T1030), where an attacker breaks down data into smaller pieces to evade detection.
Suricata
