Malicious Installer Package for Event Trigger Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the download of installer packages (MSI, PKG, DEB, RPM) over HTTP that contain the string 'CustomAction'. This combination is often used by malicious installers to establish persistence on a system by creating custom actions that execute at specific events.