Renamed System Binary Used as Proxy Execution
This rule detects the use of renamed system binaries (svchost, explorer, lsass, csrss) with appended digits (e.g., svchost1.exe) being used as proxy execution. It specifically looks for HTTP responses containing a Windows executable (MZ header) where the HTTP URI matches the pattern of these renamed binaries. This behavior is often indicative of defense evasion tactics by malware.
Suricata
