Drive-by Download via Malicious Advertisement
This rule detects a drive-by download attempt initiated via a malicious advertisement. It specifically looks for HTTP responses to clients where the HTTP referer header contains common advertisement-related keywords (ad., ads., advert) and the response body contains the 'MZ' magic bytes, indicating an executable file download. This combination suggests a user was redirected from an advertisement to a site that then attempted to download an executable.
Suricata
