Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
IDS Classtypes
1
IDS Protocols
2,431
868
408
324
97
1
This rule detects large data transfers over FTP, specifically looking for FTP data connections (flow:to_server,established) where the data size exceeds 65000 bytes. It uses a threshold of 10 such transfers within 60 seconds from the same source to trigger an alert, indicating potential data exfiltration. This aligns with MITRE ATT&CK technique T1048.003, which involves exfiltrating data over FTP.
