Email Data Exfiltration via High Volume or Suspicious Destination
This rule detects potential data exfiltration attempts via email by monitoring internal users sending emails to external domains. It flags suspicious activity based on three criteria: a high volume of emails sent (over 100) combined with a large total data size (over 50 MB), a significant number of emails sent to personal domains (over 20), or a notable count of emails with sensitive subjects (over 5). The rule aggregates these metrics over a 1-day window for each user.
Sigma
