ISO or IMG File Download Used as Malware Container

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.