Suspicious Financial Keywords in Network Traffic

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•1

This rule detects network connections where the remote URL contains keywords commonly associated with financial transactions or sensitive financial information, such as 'neft', 'rtgs', 'imps', 'gst', 'pan', and 'ifsc'. This could indicate data exfiltration, unauthorized access to financial systems, or other malicious activities targeting financial data.