ATT&CK T1074 - Internal Data Staging: Large Transfer

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•6

This rule detects large internal data transfers within the network. Specifically, it triggers when the data size of an established TCP flow exceeds 65000 bytes. A threshold is applied, alerting if 50 such transfers occur from the same source within a 60-second window. This behavior is often associated with internal data staging, a technique used by attackers to collect and consolidate data before exfiltration.