Ransomware MBR Wiper Payload Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects the delivery of a potential ransomware MBR (Master Boot Record) wiper payload via HTTP. It specifically looks for HTTP responses containing file data that starts with the byte sequence '55 AA' (which often indicates a boot sector or MBR) and also contains 'MZ' (the DOS executable signature), with a file size greater than 10,000 bytes. This combination suggests a malicious executable designed to overwrite the MBR, a common tactic used by certain types of ransomware or disk wipers.