CVE Proof of Concept Code Download
This rule detects the download of potential proof-of-concept (PoC) exploit code for CVEs. It specifically looks for HTTP responses containing a URI that matches the pattern 'CVE-YYYY-NNNN' (e.g., CVE-2023-1234) and also contains the word 'exploit' in the file data. This combination suggests that a client on the internal network is downloading code related to a known vulnerability, which could be for research, testing, or malicious purposes.
Suricata
