ET HUNTING Possible EXE Download From Suspicious TLD

flow:established,to_client;
file_data;
content:"MZ"; within:2;
byte_jump:4,58,relative,little;
content:"PE|00 00|"; distance:-64; within:4;
flowbits:isset,ET.SuspExeTLDs;

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

• correlates · Suricata flowbits ET.SuspExeTLDs
  • ET HUNTING Possible EXE Download From Suspicious TLD (.gdn) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.icu) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.science) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.top) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.stream) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.download) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.biz) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.accountant) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.click) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.link) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.win) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.men) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.webcam) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.yokohama) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.tokyo) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.gq) - set
  • ET HUNTING Possible EXE Download From Suspicious TLD (.work) - set