ATT&CK T1105 - Executable Download via HTTP

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects the download of executable files (such as .exe, .dll, .bat, .ps1, .vbs, .hta) over HTTP. It specifically looks for the 'MZ' header, which is characteristic of Windows executables, and checks the HTTP URI for common executable file extensions. This activity is often associated with initial access or command and control techniques where adversaries download malicious payloads.