Malicious MSI Package Delivered via HTTP
This rule detects the delivery of a Microsoft Installer (MSI) package via HTTP that exhibits characteristics of a malicious file. It specifically looks for HTTP responses (flow:to_client) containing a URI with the ".msi" extension (http.uri; content:".msi"; nocase;) and the magic bytes "D0 CF 11 E0" (content:"|D0 CF 11 E0|"; depth:4;) which are indicative of an OLE2 compound document file format, commonly used by MSI files. The rule classifies this activity as 'trojan-activity'.
Suricata
