TeamPCP Data Exfiltration via Custom HTTP Header

Brandon Rodriguez@BMRodriguez

•updated Mar 25, 2026•12•0•139

Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz' used by the TeamPCP credential harvester for data exfiltration. This rule targets a highly specific Indicator of Compromise (IOC) associated with the TeamPCP threat.