Rootkit Payload Delivered via HTTP Download

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the delivery of a potential rootkit payload via HTTP download. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'rootkit', 'rkill', 'kernel.module', or 'lkm' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.