Large Archive Upload - Possible Data Staging

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects large HTTP POST requests containing GZIP compressed data (identified by the magic bytes '|1F 8B|') with a size greater than 100,000 bytes. This behavior is indicative of possible data staging or exfiltration, where an attacker might compress and upload sensitive data from a compromised system.