Exploit Framework Tool Download Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to download known exploit framework tools such as Metasploit, Cobalt Strike, Empire, Covenant, Sliver, or Havoc by inspecting HTTP URI content. The detection is based on case-insensitive pattern matching within the HTTP URI.