MMC Snap-in Used for Malicious Proxy Execution
This rule detects the download of a Microsoft Management Console (MMC) snap-in file (.msc) over HTTP that also contains the string "MMCVersion". This combination is often used by attackers to execute malicious code or establish persistence, leveraging the trusted nature of MMC snap-ins. The rule specifically looks for the file extension in the URI and the 'MMCVersion' string within the file's data, indicating a potential malicious MMC snap-in being delivered via HTTP.
Suricata
