This can be done but takes work and is prone to false positives. I personally got a email from out network team asking what I was doing when I downloaded some very large files on a VM in our test environment. I was impressed.