Exfiltration to Mega.nz Cloud Storage by Non-Browser Process (T1567.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects high-volume or repeated outbound connections to Mega cloud storage domains (mega.nz, mega.co.nz, etc.) by processes that are not identified as standard web browsers. Such activity may indicate data exfiltration, automated file staging, or unauthorized use of cloud storage services.