APC Injection via QueueUserAPC Payload Delivery
This rule detects potential APC (Asynchronous Procedure Call) injection attempts over HTTP by looking for the presence of both 'QueueUserAPC' and 'OpenThread' functions in the HTTP response body (flow:to_client). This combination of functions is indicative of a payload delivery mechanism often used in APC injection techniques, which can lead to privilege escalation or arbitrary code execution.
Suricata
