Cron-Timed Data Upload to External Server

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects HTTP POST requests from the home network to any external server where the request body size is greater than 10000 bytes. It uses a threshold to alert if 5 such events occur from the same source IP within an hour, indicating a potential cron-timed data upload or exfiltration attempt.