Large File Transfer with text-plain MIME Type
The rule detects large file transfers where the MIME type is declared as 'text/plain' but the file size exceeds 1,000,000 bytes. It specifically looks for files originating locally and excludes transfers to internal IP addresses. This behavior is often used by C2 frameworks to disguise binary payloads or exfiltrated data as harmless text to evade proxy inspection.
Sigma
