DDE Attack Payload in CSV File Download

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the download of a CSV file that contains a Dynamic Data Exchange (DDE) attack payload. Specifically, it looks for HTTP responses delivering a file with a '.csv' extension and the string '=HYPERLINK(' within the file data, indicating a potential DDE exploit attempt.