User Clicked Malicious Link Leading to Payload

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects when a user clicks on a malicious link, indicated by a referrer from common email/webmail services (mail., webmail., outlook., gmail.), and the subsequent HTTP response contains a Windows executable (MZ header). This suggests a drive-by download attempt or a user being tricked into downloading malware after clicking a phishing link.