Execution Flow Hijack Library Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the delivery of a Windows Dynamic Link Library (DLL) file via HTTP that could be used for execution flow hijacking. It specifically looks for HTTP responses containing a URI with '.dll', the 'MZ' magic bytes at the beginning of the file data, and a file size greater than 10,000 bytes, indicating a potentially legitimate or malicious DLL being downloaded to a client.