Malicious Office Template Injection Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects the download of a malicious Office template file (.dotm) over HTTP. The rule specifically looks for HTTP traffic flowing to the client that contains the ".dotm" string in the URI, indicating a potential template injection attack where a malicious template is delivered to a user.