Paste Site Used as Payload Hosting

Darshan Thummar@Mighty

•updated Jun 10, 2026•3•0•10

This rule detects HTTP POST requests to known paste sites (pastebin.com, paste.ee, hastebin.com) with a data size greater than 500 bytes. This behavior is often associated with adversaries using these sites to host malicious payloads or exfiltrate data.