Credential Harvesting Form Submission Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects potential credential harvesting attempts by monitoring HTTP POST requests that contain both 'password' and 'email' in the client body. It specifically looks for these keywords in a case-insensitive manner within the HTTP client body and requires the body size to be greater than 50 bytes. This indicates a form submission likely containing sensitive user credentials.