CSS-bomb per-keystroke exfiltration via rapid browser GET bursts

Ankit Mehta@Secvyn

•updated Aug 9, 2026•4•2•1

This rule detects rapid, high-volume outbound network requests to a single remote host from common web browsers (msedge.exe, chrome.exe, outlook.exe, firefox.exe). It identifies suspicious behavior where a browser performs at least 10 requests to 10 distinct URLs in a 30-second window, which is indicative of potential per-keystroke exfiltration or automated data scraping.