Network Data Exfiltration via Chunked Transfer
Detects anomalous data transfer patterns characteristic of exfiltration by identifying a high frequency of relatively small, uniform data chunks sent to an external destination. By aggregating these chunks, the rule identifies cumulative data transfers that exceed the defined organizational threshold for a single connection, potentially bypassing security controls that monitor only individual file transfer sizes.
Microsoft Sentinel (KQL)
