Custom XOR Compressed Archive Exfiltrated via HTTP

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects the exfiltration of a custom XOR-compressed archive over HTTP. It specifically looks for HTTP POST requests originating from the home network, containing file data, with a payload size greater than 10000 bytes, and a PCRE match for a sequence of at least 200 non-ASCII or control characters, which is indicative of XOR-compressed binary data.