CVE-2025-60727 Malformed Excel OOXML HTTP Download RCE Attempt

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•6

Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.