Signed Binary Used as Proxy for Malicious Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP responses that contain a Windows executable (indicated by 'MZ' header) and where the HTTP URI path contains specific Windows utility names (mshta, rundll32, regsvr32, msiexec, installutil, cmstp). This combination suggests a potential attempt to use signed binaries as proxies for malicious execution, a common defense evasion technique.