Large Encrypted Data Upload on Alternate TLS Port

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects large encrypted data uploads (over 65KB) on TCP port 8443, which is an alternate port often used for TLS/HTTPS traffic. The rule triggers if 10 such uploads occur from the same source within 60 seconds, indicating a potential policy violation or data exfiltration attempt.