Obsidian Sandstorm: Large Outbound HTTP/S Exfil from Doc Editors After LDAP Credential Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.