High Volume Large Data Transfers from IIS

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•5

This rule identifies potential data exfiltration or unusual data transfer activity by detecting a high volume of large data transfers (over 1MB per transfer) from or to an IIS web server. It aggregates these transfers hourly by client IP and alerts if 10 or more such transfers occur within that hour from a single IP.