F5 BIG-IP Webshell or Exfiltration Staging via HTTP POST
Detects HTTP POST requests to F5 BIG-IP management or shared endpoints that contain long, base64-encoded payloads. Threat actors may use this technique to upload webshells or stage data for exfiltration.
Sigma
