Removable Media File Contents Exfiltrated via HTTP

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential data exfiltration of removable media file contents over HTTP. It specifically looks for HTTP POST requests to a URI containing "upload" with a payload size greater than 50,000 bytes. A threshold is applied to prevent excessive alerts, triggering if 5 such events occur from the same source within 60 seconds.