Password Manager Database File Exfiltrated

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects potential exfiltration of password manager database files over HTTP. It specifically looks for HTTP POST requests with a URI containing common password manager names (keepass, lastpass, 1password, bitwarden) and a data size greater than 1000 bytes. This combination suggests a large file, potentially a database, is being uploaded.