Executable Masquerading as Image File
This rule detects when an executable file is masquerading as an image file during an HTTP download. It specifically looks for HTTP responses with a 'Content-Type: image/' header, but where the file data begins with 'MZ', which is the magic number for Windows Portable Executable (PE) files. This indicates a potential attempt to bypass security controls by disguising malicious executables as benign image files.
Suricata
