Purchased Exploit Kit Download Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects the download of known exploit kits by inspecting HTTP URI patterns. It specifically looks for the strings 'rig', 'fallout', 'spelevo', or 'purplefox' followed by 'kit' (case-insensitive) within the HTTP URI. The detection is triggered on traffic flowing to the client that is part of an established connection.