Keylogger Data Exfiltrated via HTTP POST

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the string 'keys' (case-insensitive) and the data size is greater than 200 bytes. This combination suggests that a keylogger might be sending captured keystrokes or other sensitive data to a remote server.