System Firmware Update from Unverified Source

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to update system firmware from an unverified source. It specifically looks for HTTP traffic (flow:to_client,established) where the URI contains the string "firmware" (case-insensitive) and the file data contains the byte sequence "AA 55". This combination suggests a potential firmware update being delivered over HTTP, which could be malicious if the source is not legitimate.