Data Staged in Cloud Storage Before Exfiltration

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.