Process Doppelganging via TxF Transaction Payload

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects potential Process Doppelganging attempts by looking for specific Windows API calls related to Transactional NTFS (TxF) within HTTP traffic. Specifically, it looks for the presence of "NtCreateTransaction" and "NtCreateSection" in the file data of HTTP responses, indicating a payload that might be attempting to leverage TxF for process creation manipulation.