Windows API Call Shellcode Delivery via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects potential shellcode delivery over HTTP by looking for the presence of specific Windows API function names, 'VirtualAlloc' and 'WriteProcessMemory', within the file data of HTTP responses. These API calls are commonly used in shellcode to allocate memory and write malicious code into a process.