Data Staged on Remote Share Before Exfiltration

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential data staging activity on a remote SMB share. It specifically looks for traffic to port 445 (SMB) containing 'ADMIN$' (case-insensitive) with a data size greater than 65000 bytes. A threshold of 20 such events within 60 seconds from the same source IP will trigger an alert, indicating a high volume of data being transferred to an administrative share, which could precede exfiltration.