RC4 Encrypted Malware Payload Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects potential malware payloads encrypted with RC4. It specifically looks for HTTP responses (flow:to_client,established) containing the string "RC4" (case-insensitive) and a long base64-like string (at least 100 characters, optionally ending with padding) within the file data. This combination suggests an RC4-encrypted payload being delivered to a client.