Post-Exploitation Framework Binary Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects the download of a potential post-exploitation framework binary over HTTP. It looks for HTTP responses containing the 'MZ' magic bytes (indicating a Windows executable) and specific keywords like 'beacon', 'agent', 'implant', 'payload', or 'stager' in the HTTP URI. This combination suggests an attempt to deliver malicious tools to a compromised system.