Large File Transfers to Non-Internal IPs via Tor
This rule identifies potential large file transfers from internal hosts to external hosts over the Tor network. It specifically looks for files seen on the Tor network (index=onion) originating from a local source (local_orig=true) with a size greater than 500KB (seen_bytes>500000). It excludes transfers to private IP addresses. The rule then groups these transfers by source IP, destination IP, and seen bytes, and flags instances where the same transfer (defined by source, destination, and size) occurs 5 or more times.
Splunk (SPL)
