VelvetCake HTTP exfiltration of staged recon/screenshot data via logout.php

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•6

Detects network traffic indicative of VelvetCake malware exfiltrating data. The rule specifically monitors for HTTP POST requests to 'logout.php' containing 'OKey' and 'Who' parameters, using a user agent string that includes 'WebClient', which is often associated with PowerShell-based network requests.