Malware Masquerading as Legitimate Windows Binary

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.