Wireless Network List Exfiltrated via HTTP POST

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects attempts to exfiltrate wireless network lists (SSIDs) over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "SSID" (case-insensitive). This activity is indicative of a trojan attempting to steal network information.