Security Defense Impairment Command Delivered
This rule detects the string "DisableAntiSpyware" in HTTP response bodies. This string is often associated with commands or responses related to disabling security defenses, specifically anti-spyware features, which is a common tactic used by malware or attackers for defense evasion. The rule is designed to alert when such a command or response is delivered to a client within an established HTTP flow.
Suricata
