Process Injection Toolkit Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the delivery of a process injection toolkit over HTTP by looking for the presence of specific Windows API function names, 'VirtualAllocEx' and 'WriteProcessMemory', within the HTTP response body. These functions are commonly used in process injection techniques to allocate memory in a remote process and write malicious code into it.