Large Plain Text File Transfer to External IP
This rule detects large text files (over 1MB) downloaded from the Tor network (index=onion) to a local host, where the destination IP address is not a private or loopback address. It specifically looks for files with a MIME type of 'text/plain' and where 'local_orig' is true, indicating the file originated from the local network. The rule filters out internal network traffic by excluding private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), and APIPA addresses (169.254.0.0/16) from the responder's IP address.
Splunk (SPL)
