Large Outbound Data Transfer Possible Pre-Ransomware Exfiltration
Detects unusually large outbound data transfers (over 500MB) that may indicate data exfiltration preceding Chaos ransomware deployment, consistent with STAC4749 incidents where data was likely stolen before encryption.
Microsoft Sentinel (KQL)
