Shellcode Delivery via HTTP - NOP Sled Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects the delivery of shellcode via HTTP that contains a NOP sled pattern. The rule specifically looks for a sequence of eight or more '90' (hexadecimal) bytes in the HTTP response body, which is a common indicator of a NOP sled used to prepare for shellcode execution. The detection is focused on traffic flowing from the server to the client over an established HTTP connection.