User Execution - Payload Disguised as Media File
This rule detects attempts to download executable files disguised as common media file types (MP4, MP3, AVI, MOV) over HTTP. It specifically looks for the 'MZ' header, which indicates a Windows executable, within the first two bytes of the file data, combined with a URI ending in a media file extension. This technique is often used by attackers to bypass security controls and trick users into executing malicious payloads.
Suricata
