Description
Detects network traffic carrying the Windows executable DOS stub that MSI and PE installer binaries carry. Identifying installer binaries in transit supports file blocking and inspection policies, since installers are a common malware delivery format.