Large File Transfer Through Web Proxy to External IP

Jorden Smith@Jorden

•updated Feb 10, 2026•0•18

This rule detects large outbound file transfers, specifically those exceeding 1MB per file, from an internal host to an external IP address, as tracked by Zeek's file logs. It serves as a baseline for volume aggregation. A correlated rule then aggregates these individual transfers, triggering an alert if the total volume of files transferred to a specific external IP from a specific internal host exceeds 15MB within a 10-minute window. This aggregation aims to detect exfiltration attempts where data might be split into smaller chunks to evade single-file size limits.