NSIS InetLoad downloader user agent
This rule detects the distinctive 'NSIS_InetLoad Mozilla' user-agent string, which is commonly used by staged downloaders. It specifically targets network events where the process image name ends with '.exe' and either the event subtype or the remote IP contains the 'NSIS_InetLoad Mozilla' string. The rule aims to identify the initial stages of malware delivery and execution, providing causality fields for investigation.
Cortex XDR
