High Volume Data Exfiltration to Known Malicious IPs

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

This rule detects high volume data exfiltration (over 1GB) from devices to a list of known malicious IP addresses within a one-hour window. It specifically looks for network events where a significant amount of data (SentBytes > 100MB initially, then summed to over 1GB) is sent to hardcoded remote IP addresses associated with potential command and control or data exfiltration infrastructure.