Financial Transaction Data Modified in Transit

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects potential tampering with financial transaction data during transit. It specifically looks for TCP traffic flowing to a server, where the data size is between 100 and 500 bytes, and the content contains both "amount" and "transfer" (case-insensitive). This combination suggests an attempt to modify financial transaction details.