BEK2 Executables

This will detect multiple BEK2 executables across multiple variants.

HTTP Request Method = GET
Content Type = “application/x-msdownload”
HTTP URI =*.php?*
Regex HTTP URI for “([1-3][a-z0-9]:){9}[1-3][a-z0-9]”

Comments are closed.