Browser Credential Exfiltration via HTTP POST

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.