ET HUNTING HTTP Executable Download from suspicious domain with direct request/fake browser (multiple families)

flow:from_server,established;
flowbits:isset,ET.Suspicious.Domain.Fake.Browser;
file_data;
content:"MZ"; within:2;
byte_jump:4,58,relative,little;
content:"PE|00 00|"; fast_pattern; distance:-64; within:4;

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

• correlates · Suricata flowbits ET.Suspicious.Domain.Fake.Browser
  • ET MALWARE HTTP Request to a *.su domain with direct request/fakebrowser (multiple families flowbit set)
  • ET MALWARE HTTP Request to a *.pw domain with direct request/fake browser (multiple families flowbit set)