System Binary Replaced via Malicious Update
This rule detects attempts to replace system binaries via malicious updates by inspecting HTTP responses. It specifically looks for HTTP traffic directed to the client, containing a file with the 'MZ' header (indicating a Windows executable) and a URI path that suggests a system binary location (e.g., /bin/, /sbin/, /usr/bin/). This combination indicates a potential malicious update delivering an executable to a critical system directory.
Suricata
