Large Data Staged on Remote Host via SSH SCP

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects large data transfers (over 65KB) to a remote host via SSH SCP (port 22) within the home network. It uses a thresholding mechanism to alert if 30 such transfers occur within a 60-second window from the same source.