Collected Data Archived Before Exfiltration

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.