This anomaly rule detects HTTP POST requests that contain heavily encoded payloads in the request body, signaling potential obfuscated C2, exfiltration, or payload delivery. It leverages Zeek HTTP logs and the Zeek post_body extraction to evaluate each POST body for encoding. The detection applies two pattern checks: one for hex-encoded sequences (eight or more consecutive hex escapes or percent-encoded hex bytes) and one for base64-encoded blocks (sixteen or more consecutive base64 character groups). If either condition is met, the rule classifies the encoding type as Hexadecimal, Base64, or a combination of both, and flags the event. The query groups results by source, destination, destination port, URI, HTTP method, and status code, recording first/last times and the encoding type observed. It relies on the http_post_request_with_encoded_payload_filter macro to format results and uses Zeek HTTP data sources to produce the encoding indicators. The rule aligns with MITRE techniques T1071.001 (Web Protocols) and T1132.001 (Data Encoding) and is intended for network telemetry analysis within Splunk Enterprise/Splunk ES/Splunk Cloud. Deployment prerequisites include ingesting Zeek HTTP logs via the latest Splunk Add-on for Zeek and configuring Zeek with a post_body extraction policy so the post_body field is populated; ensure the zeek_http macro matches your sourcetype. Common false positives include legitimate applications transmitting encoded payloads, so review the destination, URI, and post_body context to determine expected behavior. The analytic context supports potential Command and Control or Data Exfiltration scenarios, and a True Positive test dataset is provided to validate detections.