Large Outbound Data Transfer Spike to External C2 Host (Possible Credential/Recon Exfiltration)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•10•0•15

This rule identifies endpoints that have transferred a total of more than 50MB of data to a single external, non-private IP address. The detection filters out RFC1918 private subnets and local loopback traffic, aggregating byte counts and connection attempts per endpoint, computer, and destination. This is indicative of potential data staging or exfiltration activities.