title: Large Outbound Data Transfer
id: f0efba8d-32db-549d-950d-b339bf124348
custom_id: wf-dlp-004
status: stable
level: high
description: |
    Detects large outbound data transfers that exceed typical thresholds,
    potentially indicating data exfiltration via network protocols. Focuses
    on client-originated bytes to external destinations.
author: WitFoo
date: 2026-02-21
tags:
    - attack.exfiltration
    - attack.t1048
references:
    - https://attack.mitre.org/techniques/T1048/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        clientBytes|gte: 52428800
    condition: selection
fields:
    - clientIP
    - serverIP
    - clientBytes
    - totalBytes
    - protocol
    - userName
    - application
falsepositives:
    - Cloud backup uploads
    - Large file transfers to approved SaaS platforms
    - Video conferencing uploads
    - Software repository pushes