This tag isnt new for CEK, but has become increasingly popular over the past few weeks.
You can regex URI with this for the various payloads (pdf, jar, swf…etc)
The exe is easy enough to find with the below. Have seen it with many variations, all numerical, with jpg extension…
HTTP Method = GET
HTTP URI contains /world/
Content-Type = application/x-msdownload