Large sustained outbound data transfer to external host (possible mass exfiltrat

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects large and sustained outbound TCP data transfers to external networks, which may indicate mass data exfiltration. The rule monitors established sessions and uses a threshold to identify unusual outbound traffic volume over an extended period.