Screen Window List Exfiltrated via HTTP POST

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential data exfiltration of screen window lists via HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the case-insensitive string "windows" and the data size is greater than 200 bytes. This combination suggests an attempt to send information about open windows on a system to a remote server.