SignalHunt
← All rules

FW-7002

high

Large Outbound Data Transfer to an External Destination

Detects a single allowed session to an untrusted/external zone that transferred an unusually large volume of data outbound - a common network-visible signature of bulk data exfiltration.

T1041

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "action": "allow",
    "zone_dst": "untrust",
    "bytes_out|gte": 500000000
  }
}

Log source: category=firewall · Event ID(s): fw_allow

Required log fields

  • action
  • zone_dst
  • bytes_out

Enabling this in your environment

Where: Firewall traffic logging - session end, with byte counters

Enable traffic logging at session end (not session start) with byte counters included in the log record.

Session-start-only logging never captures bytes_out - the session hasn't finished transferring anything yet when that log line is written - so this rule is unevaluable unless session-end logging is on.

False positives

  • Legitimate large file transfers, backups, or software updates to cloud storage
  • Video conferencing or streaming sessions
  • Scheduled data replication to a partner network or cloud provider

References