ATT&CK T1068 - Kernel Exploit Delivery via HTTP

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects the delivery of a kernel exploit via HTTP. It specifically looks for HTTP responses (flow:to_client) containing a file with the 'MZ' header (indicating a Windows executable) and the string 'exploit' (case-insensitive) in the HTTP URI. This combination suggests an attempt to deliver a malicious executable, potentially a kernel exploit, to a client system.