add get http custom header

[msanchit-dev]

ref #3

• Adds detection for HttpQueryInfo usage with HTTP_QUERY_CUSTOM.
• passes lint checks (without example).

Rationale
The Malware Case Study describes how Zeus Malware uses the HTTP_QUERY_CUSTOM flag within the HttpQueryInfo() API to validate its Command-and-Control (C2) communications. By querying for a non-standard "HALL" header in the server's response, the malware performs a stealthy handshake to confirm it has reached an authentic drop site.

BreadBear is a prototype malware based on Bleeding Bear. In the proposed attack chain, HTTP_QUERY_CUSTOM is used to programmatically retrieve the Content-Length of a stage 3 payload from a Discord CDN response. This allows the malware to allocate a precise amount of memory via malloc() for the incoming base64-encoded binary.

The ddabx.dll malware uses the HTTP_QUERY_CUSTOM flag with HttpQueryInfo() to extract command-and-control (C2) data hidden within non-standard HTTP headers like g_InstallPath and g_InstallDll. By searching for these custom headers instead of the standard response body, the malware effectively bypasses basic web filters and security tools that only inspect common traffic fields.

Attackers can use custom HTTP headers to perform OSINT reconnaissance by finding leaked source code or internal configurations on platforms like GitHub using Google dorking.

[mike-hunhoff]

Thanks @msanchit-dev , I've left a quick comment for your review.

[msanchit-dev]

Thanks @mike-hunhoff . I have incorporated your feedback.

[mike-hunhoff]

@msanchit-dev lints are failing - please ensure all lints pass locally before requesting another review.

[msanchit-dev]

My apologies for not running lint again after renaming the rule. I had run it earlier but missed to run it after the rename. I have fixed the lint error:

$ python ../capa/scripts/lint.py --thorough -t "get custom HTTP header" -v .
INFO     lint: collecting potentially referenced samples                                                                                                                                              lint.py:1238
INFO     lint: no lints failed, nice!