Exfiltration Over Webhook Services - Outbound POST from Non-Browser Processes

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•4

This rule detects outbound network connections to common webhook and temporary storage services (e.g., discord.com webhooks, webhook.site, pipedream.net) initiated by processes other than standard web browsers. Such behavior is often indicative of automated data exfiltration, command-and-control (C2) communication, or malicious script activity using these services to bypass traditional network defenses.