Potential Data Exfiltration or Command and Control Activity via HTTP with Small, Repetitive Responses
This rule detects potential web scraping or automated data exfiltration activities by identifying clients making a high number of HTTP requests (at least 5 requests within a 5-second window) to a single destination host and port. The detection is further refined by looking for patterns where these requests have very similar response body lengths (at most 3 unique sizes) and target a very limited number of URIs (at most 2 unique URIs). This behavior can indicate an automated process systematically collecting specific data from a web server.
Splunk (SPL)
