Financial Transaction Hijack via Banking Trojan
This rule detects HTTP POST requests that are likely associated with financial transaction hijacking by banking Trojans. It specifically looks for HTTP POST requests where the host header or URI contains keywords related to banking or payment services (bank, paypal, stripe, wise, transferwise) and the URI also contains the word 'transfer'. Additionally, the request body size must be greater than 200 bytes, indicating a substantial data transfer, which is common in financial transactions.
Suricata
