Password Store Database Exfiltrated via HTTP POST

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the exfiltration of a password store database over HTTP POST. It specifically looks for HTTP POST requests where the URI or content contains the string "passwords" (case-insensitive) and the data size is greater than 1000 bytes. This combination suggests a large file, potentially a database, containing passwords being sent out of the network.