Browser Bookmarks Exfiltrated via HTTP POST

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects the exfiltration of browser bookmarks over HTTP POST requests. It specifically looks for HTTP POST requests where the client body contains the string "Bookmarks" (case-insensitive) and the data size is greater than 500 bytes. This pattern is indicative of an attacker or malware attempting to steal a user's browser bookmarks.