Browser Exploit Delivery via Heap Spray

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects potential browser exploit delivery via heap spray techniques. It specifically looks for a sequence of 12 NOP (No Operation) instructions (0x90) in HTTP response data flowing to a client. This pattern is commonly used in heap spray attacks to prepare memory for shellcode execution.