Process Injection Shellcode Payload in HTTP Response

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects potential process injection shellcode payloads within HTTP responses. It specifically looks for the presence of the strings "OpenProcess" and "CreateRemoteThread" (case-insensitive) in the file data of HTTP responses flowing from the server to the client. These API calls are commonly used in process injection techniques to gain control over another process and execute malicious code.