TeamPCP - Actor-Branded Custom HTTPS Header Gate (T1041)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•3•0•6

Detects the HTTPS POST exfiltration enforcing the server-side gate using the actor's custom X-Rise-To-The-Trinny: agree header or X-QT-SR: 14 header, associated with TeamPCP supply chain attacks.