Malicious DLL Delivered via HTTP Download
This rule detects the delivery of a malicious DLL (Dynamic Link Library) file via HTTP download. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".dll" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This combination suggests a DLL being downloaded to a client system, which could be part of a malware delivery chain.
Suricata
