TAG-182 Staged Download of Fake VPN/Media-Player Lure Archive (YEPlayer/Pis2rayVPN)

Duo Tech@duotech

•updated Jul 7, 2026•0•0•4

This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.