diff --git a/scripts/test-all-policy.zeek b/scripts/test-all-policy.zeek
index 4e76a54171..cf75ed5aa0 100644
--- a/scripts/test-all-policy.zeek
+++ b/scripts/test-all-policy.zeek
@@ -72,7 +72,7 @@
 @load frameworks/notice/extend-email/hostnames.zeek
 @load files/x509/disable-certificate-events-known-certs.zeek
 @load frameworks/packet-filter/shunt.zeek
-@load frameworks/signatures/iso-9660.zeek
+# @load frameworks/signatures/iso-9660.zeek
 @load frameworks/software/version-changes.zeek
 @load frameworks/software/vulnerable.zeek
 # @load frameworks/spicy/record-spicy-batch.zeek
diff --git a/scripts/zeekygen/__load__.zeek b/scripts/zeekygen/__load__.zeek
index 80a530bc3b..5cda9d6263 100644
--- a/scripts/zeekygen/__load__.zeek
+++ b/scripts/zeekygen/__load__.zeek
@@ -10,6 +10,7 @@
 @load frameworks/management/node/__load__.zeek
 @load frameworks/management/node/main.zeek
 @load frameworks/files/extract-all-files.zeek
+@load frameworks/signatures/iso-9660.zeek
 @load policy/misc/dump-events.zeek
 @load policy/protocols/conn/speculative-service.zeek
 
diff --git a/testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/files.log.cut b/testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/files.log.cut
new file mode 100644
index 0000000000..3299024504
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/files.log.cut
@@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+fuid	source	mime_type	filename
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
+FJYJFE2AmtoQavCYEh	HTTP	application/vnd.ms-cab-compressed	windows6.0-kb955430-x86-express_9c8a57958486102e94e591384dc69dd7e8d01169.cab
diff --git a/testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/http.log.cut b/testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/http.log.cut
new file mode 100644
index 0000000000..952f611b2b
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.files.mime.vnd.ms-cab-compressed-multi-conn/http.log.cut
@@ -0,0 +1,7 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+uid	method	host	status_code	resp_fuids	response_body_len	resp_mime_types
+CHhAvVGS1DHFjwGM9	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	5473	-
+ClEkJM2Vm5giqnMf4h	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	6622	-
+C4J4Th3PJpwUYZZ6gc	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	7551	-
+CtPZjS20MLrsMUOJi2	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	11791	-
+CUM0KZ3MLUfNB0cl11	GET	au.download.windowsupdate.com	206	FJYJFE2AmtoQavCYEh	8181	application/vnd.ms-cab-compressed
diff --git a/testing/btest/Traces/http/vnd.ms-cab-compressed-multi-conn.pcap b/testing/btest/Traces/http/vnd.ms-cab-compressed-multi-conn.pcap
new file mode 100644
index 0000000000..db4aed21b4
Binary files /dev/null and b/testing/btest/Traces/http/vnd.ms-cab-compressed-multi-conn.pcap differ
diff --git a/testing/btest/scripts/base/files/mime/vnd.ms-cab-compressed-multi-conn.zeek b/testing/btest/scripts/base/files/mime/vnd.ms-cab-compressed-multi-conn.zeek
new file mode 100644
index 0000000000..80b3895992
--- /dev/null
+++ b/testing/btest/scripts/base/files/mime/vnd.ms-cab-compressed-multi-conn.zeek
@@ -0,0 +1,22 @@
+# @TEST-DOC: Increasing default_file_bof_buffer_size has subtle impact on mime_type detection and association for partial file transfers over HTTP. Test mainly to aid understanding.
+#
+# @TEST-EXEC: zeek -b -r $TRACES/http/vnd.ms-cab-compressed-multi-conn.pcap %INPUT
+# @TEST-EXEC: zeek-cut -m fuid source mime_type filename < files.log > files.log.cut
+# @TEST-EXEC: btest-diff files.log.cut
+# @TEST-EXEC: zeek-cut -m uid method host status_code resp_fuids response_body_len resp_mime_types < http.log > http.log.cut
+# @TEST-EXEC: btest-diff http.log.cut
+
+@load base/protocols/http
+@load base/frameworks/files
+
+# Increases default_file_bof_buffer_size, resulting in only one of the GET
+# of http.log having the application/vnd.ms-cab-compressed associated.
+@load policy/frameworks/signatures/iso-9660
+
+redef LogAscii::use_json = F;
+
+event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
+	{
+	if ( f$source == "HTTP" )
+		f$info$filename = split_string(c$http$uri, /\//)[-1];
+	}