Data Exfiltrated to Pastebin Text Storage Site
This rule detects HTTP POST requests to pastebin.com's API for pasting content, specifically targeting the '/api/api_paste.php' endpoint. It triggers if the size of the data being uploaded is greater than 1000 bytes, indicating a potential data exfiltration attempt to a public text storage site.
Suricata
