Data Exfiltrated via Discord Webhook POST

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects potential data exfiltration attempts via Discord webhooks. It specifically looks for HTTP POST requests to discord.com/api/webhooks/ with a data size greater than 500 bytes. This could indicate an attacker sending sensitive information out of the network using Discord's API.