User Execution - Archive File Download Containing Executable

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the download of archive files (ZIP, RAR, 7Z, TAR.GZ) over HTTP that contain an executable file signature ('MZ' header). This combination suggests a potential user execution scenario where a malicious executable might be delivered within an archive.