Password Store Data Exfiltration Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This Suricata rule detects potential data exfiltration of password store information over HTTP. It specifically looks for HTTP POST requests where the client body contains both the words "password" and "username" (case-insensitive) and the body size is greater than 1000 bytes. This pattern suggests an attempt to send sensitive credential data from a compromised system to a remote server.