Data Exfiltration via TLS to Non-Standard Endpoint

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects potential data exfiltration over TLS to non-standard endpoints. It triggers when a large amount of data (greater than 65000 bytes) is sent from the home network to any destination IP on port 443 (HTTPS). A threshold is applied, triggering an alert if this occurs 20 times within 60 seconds from the same source IP, indicating a high volume of outbound encrypted traffic.