Malicious Shortened URL Redirect to Payload
This rule detects HTTP traffic where a shortened URL (from services like bit.ly, tinyurl, ow.ly, or t.co) is used in the HTTP referer header, and the HTTP response body contains the 'MZ' magic bytes, indicating a Windows executable file. This combination suggests a malicious redirect leading to the download of a payload, often associated with phishing or drive-by download attacks.
Suricata
