Sensitive Data Posted to Text Sharing Service
This rule detects attempts to exfiltrate sensitive data by posting it to common text sharing services. It specifically looks for HTTP POST requests with a body size greater than 1000 bytes directed towards domains associated with services like paste.ee, hastebin, ghostbin, and privatebin.
Suricata
