HTML File with Embedded Base64 Executable Payload

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects an HTML file being served to a client that contains an embedded Base64 encoded executable payload. It specifically looks for the HTML download attribute (<a download=), the 'base64,' string, and the 'TVQAA' string, which is a common signature for the beginning of a Base64 encoded Windows executable (MZ header). The detection is performed on HTTP traffic flowing to the client.