Environment Keyed Payload Checks Domain Before Executing

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects HTTP responses (flow:to_client) that contain specific strings indicative of an environment-keyed payload checking the domain before execution. Specifically, it looks for the case-insensitive strings "GetComputerNameEx" and "NetworkDomain" within the file data of the HTTP response. This behavior is often associated with malware attempting to determine its execution environment to evade analysis or target specific systems.