WatchGuard RCE: Large outbound data transfer volume preceding ransomware encryption

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•2

Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.