SEO Poisoned Search Result Redirect to Malware

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects HTTP responses that originate from search engines (Google, Bing, Yahoo) and contain a Windows executable (MZ header) in the file data. This behavior is indicative of SEO poisoning, where malicious actors manipulate search engine results to redirect users to malware downloads.