Polymorphic Engine Payload Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•8

This rule detects the delivery of a polymorphic engine payload via HTTP. It looks for specific content within the HTTP response body, including the strings "mutate" and "engine" (case-insensitive), and the "MZ" magic bytes at the beginning of the file data, indicating a Windows executable. This combination suggests the download of a polymorphic malware component designed to evade detection.