High Volume of Executable/Octet-Stream Downloads from IIS

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•7

This rule detects an unusually high number of downloads of files identified as 'octet-stream' or 'executable' from a single IP address within a one-hour window, based on W3CIISLog data. This behavior could indicate various malicious activities, including the distribution of malware, data exfiltration, or the use of a compromised web server for command and control.