VPN Credential Sale Access Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.