Bulk File Copy to Removable Share Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a bulk file copy pattern to a removable share over SMB (port 445). It triggers an alert if there are more than 200 SMB 'to_server' flows from a single source within a 60-second window, indicating a high volume of data transfer. This behavior is often associated with data exfiltration or large-scale data movement to external storage.