ATT&CK T1056.001 - Possible Keylog Data Exfiltration via HTTP POST

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a URI containing "keys" (case-insensitive) and a data size greater than 500 bytes. This combination suggests a large amount of data, possibly keystrokes, being sent to a server.