Large Outbound HTTP POST Possible Bulk Data Exfiltration Over 10MB

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects potential bulk data exfiltration by monitoring for outbound HTTP POST requests to non-standard ports where the Content-Length header indicates a transfer of over 10 megabytes. This behavior can be indicative of an attacker exfiltrating large amounts of sensitive data from the network to an external server.