Video Stream Exfiltration via HTTP POST
This rule detects potential video stream exfiltration over HTTP POST. It specifically looks for HTTP POST requests with a large payload size (greater than 100,000 bytes) and the byte sequence '|52 49 46 46|' at the beginning of the file data, which corresponds to the 'RIFF' header commonly found in multimedia file formats like AVI and WAV. This combination suggests an attempt to upload or exfiltrate video or audio data.
Suricata
