ATT&CK T1048.001 - HTTPS Large Upload Exfiltration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects large data uploads over HTTPS (port 443) from the home network to any external destination. Specifically, it triggers if the data size in a single TCP flow to the server exceeds 65,000 bytes. To prevent excessive alerts, it uses a threshold of 20 such events within 60 seconds, tracked by the source IP address. This behavior is indicative of potential data exfiltration.