Data Archived via Scripting Library for Exfiltration
This rule detects potential data exfiltration attempts where data is archived using scripting libraries. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "zipfile", "ZipFile(", and "write(" in the file data, indicating the use of a scripting library to create and write to a zip archive. This combination suggests that a client is receiving or downloading an archived file that was likely created programmatically for exfiltration.
Suricata
