ATT&CK T1074 - Internal Data Staging: Large Transfer

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•3

This rule detects large internal data transfers within the home network, specifically looking for TCP traffic with a data size greater than 65000 bytes. It triggers an alert if more than 50 such transfers occur from a single source within a 60-second window. This behavior is indicative of data staging, where an adversary might be collecting and consolidating data prior to exfiltration.