Potential Credential Exposure via Network Traffic

nomit vyas@xoxo

•updated Jun 24, 2026•3•0•8

This rule detects network connections where an 'access_token=' string is present in the additional fields of network events, excluding common legitimate authentication domains like Google, Microsoft, and GitHub. This could indicate the exposure of sensitive access tokens over the network.