Hidden Virtual File System Container Delivered
This rule detects the delivery of a hidden virtual file system container over HTTP. It looks for HTTP traffic flowing to the client that contains both the string "VirtualDisk" (case-insensitive) and the "MZ" header (indicating a Windows executable or DLL) within the file data. This combination suggests the download of a malicious executable designed to create or utilize a hidden virtual disk.
Suricata
