Chunked screenshot exfiltration pattern over C2 HTTPS channel
Detects a pattern of frequent (6 or more per minute) small HTTP POST requests (up to 16KB) targeting specific sensitive API or internal URI paths. The detection logic also filters for traffic originating from a specific Microsoft Edge browser user agent string on Windows 64-bit systems, which may indicate automated data exfiltration, beaconing, or communication with a Command and Control (C2) server.
Splunk (SPL)
