Browser Password Database Exfiltrated via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to exfiltrate browser password databases over HTTP. It specifically looks for HTTP POST requests containing the string "Login Data" in the client body, which is a common indicator of browser credential theft.