Compressed Executable Payload via HTTP
This rule detects the download of a compressed executable payload over HTTP. It specifically looks for HTTP traffic flowing to the client that contains both the GZIP magic number (1F 8B) and the Windows executable magic number (MZ) within the file data. This combination suggests a compressed executable file being delivered, which is a common technique used by malware to evade detection.
Suricata
