Cloud Storage Data Transferred to External Account

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects large HTTP PUT requests (over 50KB) directed towards common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage). This activity could indicate data exfiltration to an external cloud account.