Scheduled Data Transfer at Off-Hours Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•1•0•4

This rule detects scheduled data transfers occurring at off-hours, characterized by a large data size (greater than 65000 bytes) in TCP traffic flowing from the home network to any destination. It uses a thresholding mechanism to alert if 100 such transfers are observed within a 300-second window from the same source.