Unusual File Download

Daniel Koifman@Koifsec

•updated Mar 1, 2026•3•0•86

The rule detects successful HTTP downloads (response code 200 or 206) of potentially dangerous file types - including executables, scripts, disk images, shortcuts, and macro-enabled Office documents.