Large outbound HTTP PUT/POST to external service indicating bulk exfiltration

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects repeated large HTTP PUT or POST requests (exceeding 5MB) from a internal host to external destinations. This pattern is indicative of potential bulk data exfiltration over web services.