Nsis Inetload Useragent In Network Connection
Detects network connections where the user-agent string contains 'NSIS_InetLoad' and 'Mozilla', often indicative of a staged downloader. The rule also checks if the principal process is an executable and attempts to capture the user-agent from the URL or process command line.
YARA-L
