Event Hook Payload Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the delivery of a payload via HTTP that contains the string "SetWindowsHookEx" (case-insensitive). This string is associated with a Windows API function used to install a hook procedure that monitors system events. Attackers often use this technique for persistence or to inject malicious code into other processes.