Storm-2755 - Automated Script Navigating HR Portals

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•6

This rule detects automated script interaction with HR portals by correlating headless browsers or rapid HTTP POST requests sequentially navigating payroll endpoints. Specifically, it looks for network connections to URLs containing 'workday' or 'adp' initiated by 'python.exe' or 'curl.exe'.