Executable Masquerading as PDF via Content-Type

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to masquerade an executable file as a PDF document during an HTTP download. It specifically looks for HTTP responses where the 'Content-Type' header is set to 'application/pdf', but the actual file data begins with the 'MZ' magic bytes, indicating it is a Windows executable.