ATT&CK T1020 - Automated Exfiltration: Sustained Outbound Traffic

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•4

This rule detects sustained outbound network traffic with a data size greater than 1000 bytes, originating from the home network. It triggers an alert if 200 such connections are observed from the same source IP address within a 300-second window. This behavior is indicative of automated exfiltration, where an attacker continuously sends data out of the network.